aboutsummaryrefslogtreecommitdiffstats
path: root/src/lib/pubkey
Commit message (Collapse)AuthorAgeFilesLines
* In ECC avoid using significant words to dispatch the mult algoJack Lloyd2018-06-151-22/+15
| | | | | | Normally all elements will be exact number of limbs as the field. Any situation with short elements is rare and not worth optimizing for, and likely leads to some unfortunate side channel.
* Avoid overallocation of memory for EC base point multiplesJack Lloyd2018-06-141-1/+1
| | | | | | | The size is rounded up to next 8 words so there was substantial slack here. No noticable perf difference.
* Address DSA/ECDSA side channelJack Lloyd2018-06-134-17/+80
|
* Correct exception message [ci skip]Jack Lloyd2018-06-041-1/+1
| | | | The previous message was both incorrect and very misleading.
* Prevent signature malleability in DER/BER encoded sigsJack Lloyd2018-05-311-14/+35
|
* Improves "Avoid repeated allocations in XMSS chain function"Matthias Gierlings2018-05-271-1/+2
|
* Avoid repeated allocations in XMSS chain functionJack Lloyd2018-05-271-1/+4
| | | | | | | | | | | | | | | | | | | | This is the core hotspot of XMSS signatures. Avoiding the secure_vector allocation for the PRF output improves performance quite noticably. Before: XMSS_SHA2-256_W16_H10 1940.74 ms/op XMSS_SHA2-512_W16_H10 3985.98 ms/op XMSS_SHAKE128_W16_H10 1910.48 ms/op XMSS_SHAKE256_W16_H10 4074.65 ms/op After: XMSS_SHA2-256_W16_H10 1204.34 ms/op XMSS_SHA2-512_W16_H10 2498.17 ms/op XMSS_SHAKE128_W16_H10 1176.55 ms/op XMSS_SHAKE256_W16_H10 2689.76 ms/op
* Fixes XMSS leaf index bounds sanity checkMatthias Gierlings2018-05-253-5/+4
| | | | | | | | | | Prior to this patch the sanity check for XMSS leaf indices was wrongly based on the tree height. As a result only half of the one-time keys could be used. Instead base leaf index sanity check on the number of levels in a tree which equals tree height + 1. (see also: https://tools.ietf.org/html/draft-irtf-cfrg-xmss-hash-based-signatures-12#section-4.1.1)
* Add OIDS for Camellia and SM4 in GCM and CBC modesJack Lloyd2018-05-221-2/+6
| | | | Making them usable for private key encryption
* Support scrypt for encrypting private keysJack Lloyd2018-05-221-85/+164
|
* Fix PBE decoding and fix test macro checkJack Lloyd2018-05-221-1/+1
|
* DER improvementsJack Lloyd2018-05-2210-76/+102
| | | | | | | | | | | Let DER_Encoder write to a user specified vector instead of only to an internal vector. This allows encoding to a std::vector without having to first write to a locked vector and then copying out the result. Add ASN1_Object::BER_encode convenience method. Replaces X509_Object::BER_encode which had the same logic but was restricted to a subtype. This replaces many cases where DER_Encoder was just used to encode a single object (X509_DN, AlgorithmIdentifier, etc).
* Use smaller error bound when generating subgroups-style DL groupsJack Lloyd2018-05-211-1/+1
|
* Add message to BOTAN_ARG_CHECK and use it more widelyJack Lloyd2018-05-131-0/+1
|
* Add a comment on side channels hereJack Lloyd2018-04-261-4/+5
|
* Remove unused includeJack Lloyd2018-04-261-1/+0
|
* Add final annotations [ci skip]Jack Lloyd2018-04-241-3/+3
|
* Add BigInt::mod_subJack Lloyd2018-04-232-93/+63
|
* Use EC_Group::inverse_mod_order where appropriateJack Lloyd2018-04-202-6/+3
|
* Add Fermat based inversion of P-384 field elementsJack Lloyd2018-04-191-0/+72
| | | | | | | | | Cuts about 100K cycles from the inversion, improving ECDSA sign by 10% and ECDH by ~2% Addition chain from https://briansmith.org/ecc-inversion-addition-chains-01 GH #1479
* Add field inversion for P-521Jack Lloyd2018-04-181-0/+68
| | | | ECDSA sign about 10% faster, ECDSA verify and ECDH about 5% faster.
* Add optimized inversion for P-256Jack Lloyd2018-04-181-0/+75
| | | | | | Could be slightly more clever here but this is pretty decent. GH #1479
* Add EC_Group::inverse_mod_orderJack Lloyd2018-04-176-6/+21
| | | | | | | Centralizing this logic allows curve specific implementations such as using a precomputed ladder for exponentiating by p - 2 GH #1479
* Precompute for multiexponentation when verifying ECC signaturesJack Lloyd2018-04-174-15/+19
| | | | | ECDSA already did this. Improves repeated ECGDSA, ECKCDSA, SM2, and GOST signature verification by 10-15%
* Avoid potential side channel when generating RSA primesJack Lloyd2018-04-171-2/+6
| | | | | | | | | | Add a new function dedicated to generating RSA primes. Don't test for p.bits() > bits until the very end - rarely happens, and speeds up prime generation quite noticably. Add Miller-Rabin error probabilities for 1/2**128, which again speeds up RSA keygen and DL param gen quite a bit.
* Add const time annotationsJack Lloyd2018-04-151-1/+1
|
* Add an explicit test mode buildJack Lloyd2018-04-141-2/+2
| | | | GH #1537
* Merge GH #1538 Minor ECC optimizationsJack Lloyd2018-04-147-21/+105
|\
| * Various minor ECC optimizationsJack Lloyd2018-04-137-21/+105
| | | | | | | | | | | | | | | | | | Add a way of getting Montgomery representation of one. Reduce use of temporaries in variable point mult. Prefer doubling over addition in precomputing fixed window. Add Brainpool ECDH tests Improves ECDH by 2-3% across the board
* | Merge GH #1531 Improve XMSS test coverageJack Lloyd2018-04-143-12/+8
|\ \ | |/ |/|
| * Removes unused overload in XMSS_HashMatthias Gierlings2018-04-122-12/+0
| | | | | | | | - Removes overload `XMSS_Hash::h_msg_update(secure_vector<uint8_t>&)`
| * Codecov - cover MT code in XMSS_PrivateKeyMatthias Gierlings2018-04-121-0/+8
| | | | | | | | | | | | Codecov does not reach all parts of the `XMSS_PrivateKey` code because too few cores are detected during the CI run. To cover the missed codepaths always return a large enough core count if botan is compiled with coverage.
* | Merge GH #1537 Add missing XMSS signature length checkJack Lloyd2018-04-122-22/+21
|\ \
| * | Adds missing XMSS signature length check.Matthias Gierlings2018-04-122-22/+21
| | | | | | | | | | | | | | | | | | | | | | | | - Fixes out of bounds read in `XMSS_Signature` constructor when the raw signature data supplied as arguments is shorter than the signature size defined by the XMSS parameter set encoded in the `XMSS_PublicKey`. - Fixes valid signatures with arbitrary appended data to be verified as correct signature.
* | | In XMSS_Tools::bench_threads only call hardware_concurrency onceJack Lloyd2018-04-121-7/+9
| |/ |/| | | | | | | Getting this value will typically require either a system call or a cpuid call, both of which are fairly expensive.
* | Optimize EC point doubling for a == 0 and a == -3Jack Lloyd2018-04-113-9/+61
|/
* Add EC_Group::a_is_zeroJack Lloyd2018-04-112-1/+14
|
* Add DL_Group::exponent_bitsJack Lloyd2018-04-094-7/+25
| | | | Just a useful helper
* Add a Montgomery exponentiation that takes variable timeJack Lloyd2018-04-091-7/+14
| | | | | | | | In the case of RSA encryption/verification the public exponent is... public. So we don't need to carefully guard against side channels that leak the exponent. Improves RSA verification performance by 50% or more.
* Add RAII versions of get_cipher_mode and get_aeadJack Lloyd2018-04-073-14/+5
| | | | See also #1526
* Add pk_workfactor CLI and refactor workfactor estimator functionsJack Lloyd2018-04-051-12/+19
| | | | No reason to duplicate the NFS workfactor estimator twice
* Merge GH #1523 RSA optimizations and exponent blindingJack Lloyd2018-04-042-25/+53
|\
| * Work around a bug in MSVC lambda handlingJack Lloyd2018-04-041-1/+1
| |
| * Add RSA exponent blindingJack Lloyd2018-04-042-5/+14
| | | | | | | | Additional paranoia never hurt.
| * Tweak how RSA private operations are performedJack Lloyd2018-04-041-25/+44
| | | | | | | | Improves perf by about 15%
* | Add DL_Group::monty_params_p to get Montgomery paramsJack Lloyd2018-04-042-2/+13
|/
* Fix problems with failure to build in various configurationsJack Lloyd2018-03-311-1/+1
|
* Minor DH optimizationJack Lloyd2018-03-281-4/+6
| | | | Saves 30k-170k cycles depending on param size.
* Fix some Doxygen errorsJack Lloyd2018-03-281-0/+12
|
* Fix carry bugs introduced in 8a7559e4f8adJack Lloyd2018-03-272-22/+23
|
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-13 05:22:27 +0000