1 files changed, 113 insertions, 0 deletions
diff --git a/src/lib/pubkey/ec_group/point_mul.cpp b/src/lib/pubkey/ec_group/point_mul.cpp
new file mode 100644
index 000000000..7fea02280
--- /dev/null
+++ b/src/lib/pubkey/ec_group/point_mul.cpp
@@ -0,0 +1,113 @@
+/*
+* (C) 2015,2018 Jack Lloyd
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#include <botan/point_gfp.h>
+#include <botan/rng.h>
+#include <botan/internal/rounding.h>
+
+namespace Botan {
+
+PointGFp_Blinded_Multiplier::PointGFp_Blinded_Multiplier(const PointGFp& base,
+                                                         std::vector<BigInt>& ws,
+                                                         size_t w)
+   {
+   init(base, w, ws);
+   }
+
+PointGFp_Blinded_Multiplier::PointGFp_Blinded_Multiplier(const PointGFp& base,
+                                                         size_t w)
+   {
+   std::vector<BigInt> ws(9);
+   init(base, w, ws);
+   }
+
+void PointGFp_Blinded_Multiplier::init(const PointGFp& base,
+                                       size_t w,
+                                       std::vector<BigInt>& ws)
+   {
+   m_h = (w == 0 ? 5 : w);
+
+   if(ws.size() < PointGFp::WORKSPACE_SIZE)
+      ws.resize(PointGFp::WORKSPACE_SIZE);
+
+   // Upper bound is a sanity check rather than hard limit
+   if(m_h < 1 || m_h > 8)
+      throw Invalid_Argument("PointGFp_Blinded_Multiplier invalid w param");
+
+   m_U.resize(1 << m_h);
+   m_U[0] = base.zero();
+   m_U[1] = base;
+
+   for(size_t i = 2; i < m_U.size(); ++i)
+      {
+      m_U[i] = m_U[i-1];
+      m_U[i].add(base, ws);
+      }
+   }
+
+void PointGFp_Blinded_Multiplier::randomize(RandomNumberGenerator& rng)
+   {
+   // Randomize each point representation (Coron's 3rd countermeasure)
+   for(size_t i = 0; i != m_U.size(); ++i)
+      m_U[i].randomize_repr(rng);
+   }
+
+PointGFp PointGFp_Blinded_Multiplier::mul(const BigInt& k,
+                                          const BigInt& group_order,
+                                          RandomNumberGenerator& rng,
+                                          std::vector<BigInt>& ws) const
+   {
+   if(k.is_negative())
+      throw Invalid_Argument("PointGFp_Blinded_Multiplier scalar must be positive");
+
+#if BOTAN_POINTGFP_USE_SCALAR_BLINDING
+   // Choose a small mask m and use k' = k + m*order (Coron's 1st countermeasure)
+   const BigInt mask(rng, group_order.bits() / 4, false);
+   const BigInt scalar = k + group_order * mask;
+#else
+   const BigInt& scalar = k;
+#endif
+
+   if(ws.size() < PointGFp::WORKSPACE_SIZE)
+      ws.resize(PointGFp::WORKSPACE_SIZE);
+
+   const size_t scalar_bits = scalar.bits();
+
+   size_t windows = round_up(scalar_bits, m_h) / m_h;
+
+   PointGFp R = m_U[0];
+
+   if(windows > 0)
+      {
+      windows--;
+      const uint32_t nibble = scalar.get_substring(windows*m_h, m_h);
+      R.add(m_U[nibble], ws);
+
+      /*
+      Randomize after adding the first nibble as before the addition R
+      is zero, and we cannot effectively randomize the point
+      representation of the zero point.
+      */
+      R.randomize_repr(rng);
+
+      while(windows)
+         {
+         for(size_t i = 0; i != m_h; ++i)
+            R.mult2(ws);
+
+         const uint32_t inner_nibble = scalar.get_substring((windows-1)*m_h, m_h);
+         // cache side channel here, we are relying on blinding...
+         R.add(m_U[inner_nibble], ws);
+         windows--;
+         }
+      }
+
+   //BOTAN_ASSERT(R.on_the_curve(), "Output is on the curve");
+
+   return R;
+   }
+
+}