aboutsummaryrefslogtreecommitdiffstats
path: root/src/lib/math/mp
Commit message (Collapse)AuthorAgeFilesLines
* Remove unnecessary code due to compiler limitationsJack Lloyd2020-11-111-1/+1
| | | | | Use [[nodiscard]] and [[deprecated]] annotations since those are available to us now.
* Add -Wshorten-64-to-32 for ClangJack Lloyd2020-11-081-1/+1
| | | | See #2365
* Remove deprecated headers, make more headers internalJack Lloyd2020-11-061-1/+1
| | | | | | | | | Now modules default to internal headers instead of defaulting to public; making a new public API should be a visible and intentional choice. Brings the public header count from over 300 to around 150. Also removes the deprecated tls_blocking interface
* Avoid a new Clang 10 ASan findingJack Lloyd2020-04-241-2/+4
| | | | | It doesn't like expressions that evaluate to nullptr + non-zero, even though in the end we didn't do anything with the pointer.
* Remove the 32-bit x86 asm for MSVCJack Lloyd2019-11-232-272/+4
| | | | The numbers in #256 suggest that it does nothing at all for performance.
* Add constant-time gcdJack Lloyd2019-10-121-2/+3
| | | | | Previous version leaked some (minimal) information from the loop bounds.
* Small BigInt optimizationsJack Lloyd2019-08-221-3/+3
| | | | Based on profiling RSA key generation
* Fix LGTM warningJack Lloyd2019-07-051-4/+2
|
* Use C++ raw strings in inline asmJack Lloyd2019-05-032-72/+64
|
* Fix use of macroJack Lloyd2018-12-311-1/+1
| | | | Assumed to be 0/1
* Make bigint_sub_abs const timeJack Lloyd2018-12-271-6/+3
|
* Use consistent logic for OAEP and PKCS1v15 decodingJack Lloyd2018-12-211-4/+2
| | | | | | | | | | | | The decoding leaked some information about the delimiter index due to copying only exactly input_len - delim_idx bytes. I can't articulate a specific attack that would work here, but it is easy enough to fix this to run in const time instead, where all bytes are accessed regardless of the length of the padding. CT::copy_out is O(n^2) and thus terrible, but in practice it is only used with RSA decryption, and multiplication is also O(n^2) with the modulus size, so a few extra cycles here doesn't matter much.
* Avoid early exitJack Lloyd2018-12-071-4/+3
|
* Fix bug and avoid allocations in left shiftJack Lloyd2018-12-071-3/+3
|
* Const time the behavior of shifts [WIP]Jack Lloyd2018-12-061-56/+43
| | | | | | | | | They would previously leak for example if the requested shift was 0. However, that should only happen in two situations: very dumb code explicitly requested a shift of zero (in which case we don't care if performance is poor, your code is dumb) or a variable shift that just happens to be zero, in which case the variable may be a secret, for instance this can be seen in the GCD computation.
* Fix Doxygen errors [ci skip]Jack Lloyd2018-12-051-1/+0
|
* Fix a bug in bigint_sub_absJack Lloyd2018-12-021-0/+7
| | | | | | | If one of the values had leading zero words, this could end up calling bigint_sub with x_size < y_size. OSS-Fuzz 11664 and 11656
* One variable per lineJack Lloyd2018-12-021-1/+2
|
* Add BigInt::mod_mulJack Lloyd2018-12-011-0/+41
|
* Simplify BigInt addition and subtractionJack Lloyd2018-11-302-3/+36
| | | | | Addition already has to handle negative numbers so make it do double duty for subtraction.
* Add CT::Mask typeJack Lloyd2018-11-282-57/+54
|
* Make more BigInt functions const-timeJack Lloyd2018-11-262-58/+197
| | | | In particular comparisons, calc sig words, and mod_sub are const time now.
* Avoid branching in the NIST prime reduction codeJack Lloyd2018-11-091-11/+48
| | | | | This is still vulnerable to a cache-based side channel since the multiple chosen leaks the final carry.
* Inline the contents of mp_core.cppJack Lloyd2018-11-092-601/+429
|
* Remove redundant definesJack Lloyd2018-09-101-2/+0
|
* Remove support for 8 or 16 bit BigInt wordsJack Lloyd2018-08-151-8/+3
| | | | | | | | | | It turned out 8 bit was very broken (failed to compile, due to overload problems with functions taking uint8_t vs word). 16 bit words work aside from a test failure, but is really slow. Practically speaking we are not in a position to support 16-bit CPUs very well. And being able to assume sizeof(word) >= sizeof(uint32_t) allows simplifying some code.
* Specialize code for BigInt right shift by 1Jack Lloyd2018-07-191-0/+22
| | | | | Improves ECDSA by 2-3% due to improving the const time modular inversion algorithm (used for the mod-order inversions).
* Add combined conditional add-or-subtractJack Lloyd2018-06-143-5/+41
|
* Remove CT annotations from Montgomery reductionJack Lloyd2018-06-141-8/+0
| | | | | The poisons don't stack so the unpoison hid conditional jumps we want to find.
* Make Karatsuba multiply completely const timeJack Lloyd2018-06-143-19/+45
|
* Unroll bigint_monty_redc for various sizesJack Lloyd2018-06-114-24/+2691
| | | | Speedup of 10 to 30% depending on algo
* Add message to BOTAN_ARG_CHECK and use it more widelyJack Lloyd2018-05-131-2/+1
|
* Add 24-word wide Comba multiply/squareJack Lloyd2018-05-083-1/+1101
| | | | | | Improves performance on "odd" sized DH/RSA (eg 1536, 3072, 6144) where otherwise the Karatsuba operation bottoms out with 24-word operands which ended up in the basecase multiply.
* Add vars to split the two Karatsuba sub-workspacesJack Lloyd2018-04-161-14/+20
|
* Simplify Karatsuba codeJack Lloyd2018-04-153-39/+43
| | | | And set us up for eventually having this be completely const time.
* Convert comba script to Python3Jack Lloyd2018-04-081-1/+1
|
* Split up asm constructs to avoid miscompilationJack Lloyd2018-04-051-30/+49
| | | | | | | The constraints were invalid as they missed the clobber of a/d registers. This caused miscompilation when using GCC -fno-plt option. GH #1524
* Fix some Doxygen errorsJack Lloyd2018-03-281-0/+1
|
* Add basecase_sqr functionJack Lloyd2018-03-161-3/+29
| | | | | | Just a simple adaption of the n^2 multiply algorithm, so no performance impact. However makes the difference between squaring and multiply easier to see when profiling.
* Improve memory handling for PointGFpJack Lloyd2018-03-142-1/+3
|
* Add some helper functions for checking for Comba sizesJack Lloyd2018-03-101-15/+27
|
* Simplify indexing in this loopJack Lloyd2018-03-041-5/+5
|
* Fix header includesJack Lloyd2018-03-022-2/+3
|
* Implement product-scanning Montgomery reductionJack Lloyd2018-03-022-30/+88
| | | | | Results in 10-20% improvement for DH and RSA, 5% for ECC curves that use Montgomery form.
* Tiny but useful optimization in bigint_monty_redcJack Lloyd2018-03-011-1/+1
| | | | Increases perf of larger DH by 5-8%
* Loosen restrictions on using bigint_comba_sqr9Jack Lloyd2018-03-011-1/+1
|
* Move declaration of word to types.hJack Lloyd2018-03-014-39/+6
|
* Remove MP_WORD_BITS constantJack Lloyd2018-03-012-17/+12
| | | | Use the BOTAN_MP_WORD_BITS consistently
* Remove BigInt using functions from mp layerJack Lloyd2018-03-014-57/+0
|
* Avoid ternary op during carry handlingJack Lloyd2018-03-011-1/+1
| | | | Makes it less likely compiler will use add-with-carry op
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-11 14:57:53 +0000