Robert Sloan | ab8b888 | 2018-03-26 11:39:51 -0700 | [diff] [blame^] | 1 | /* |
| 2 | * Copyright 2014-2016 The OpenSSL Project Authors. All Rights Reserved. |
| 3 | * Copyright (c) 2014, Intel Corporation. All Rights Reserved. |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 4 | * |
Robert Sloan | ab8b888 | 2018-03-26 11:39:51 -0700 | [diff] [blame^] | 5 | * Licensed under the OpenSSL license (the "License"). You may not use |
| 6 | * this file except in compliance with the License. You can obtain a copy |
| 7 | * in the file LICENSE in the source distribution or at |
| 8 | * https://www.openssl.org/source/license.html |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 9 | * |
Robert Sloan | ab8b888 | 2018-03-26 11:39:51 -0700 | [diff] [blame^] | 10 | * Originally written by Shay Gueron (1, 2), and Vlad Krasnov (1) |
| 11 | * (1) Intel Corporation, Israel Development Center, Haifa, Israel |
| 12 | * (2) University of Haifa, Israel |
| 13 | * |
| 14 | * Reference: |
| 15 | * S.Gueron and V.Krasnov, "Fast Prime Field Elliptic Curve Cryptography with |
| 16 | * 256 Bit Primes" |
| 17 | */ |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 18 | |
| 19 | #ifndef OPENSSL_HEADER_EC_P256_X86_64_H |
| 20 | #define OPENSSL_HEADER_EC_P256_X86_64_H |
| 21 | |
| 22 | #include <openssl/base.h> |
| 23 | |
| 24 | #include <openssl/bn.h> |
| 25 | |
| 26 | #if defined(__cplusplus) |
| 27 | extern "C" { |
| 28 | #endif |
| 29 | |
| 30 | |
| 31 | #if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && \ |
| 32 | !defined(OPENSSL_SMALL) |
| 33 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 34 | // P-256 field operations. |
| 35 | // |
| 36 | // An element mod P in P-256 is represented as a little-endian array of |
| 37 | // |P256_LIMBS| |BN_ULONG|s, spanning the full range of values. |
| 38 | // |
| 39 | // The following functions take fully-reduced inputs mod P and give |
| 40 | // fully-reduced outputs. They may be used in-place. |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 41 | |
| 42 | #define P256_LIMBS (256 / BN_BITS2) |
| 43 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 44 | // ecp_nistz256_neg sets |res| to -|a| mod P. |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 45 | void ecp_nistz256_neg(BN_ULONG res[P256_LIMBS], const BN_ULONG a[P256_LIMBS]); |
| 46 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 47 | // ecp_nistz256_mul_mont sets |res| to |a| * |b| * 2^-256 mod P. |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 48 | void ecp_nistz256_mul_mont(BN_ULONG res[P256_LIMBS], |
| 49 | const BN_ULONG a[P256_LIMBS], |
| 50 | const BN_ULONG b[P256_LIMBS]); |
| 51 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 52 | // ecp_nistz256_sqr_mont sets |res| to |a| * |a| * 2^-256 mod P. |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 53 | void ecp_nistz256_sqr_mont(BN_ULONG res[P256_LIMBS], |
| 54 | const BN_ULONG a[P256_LIMBS]); |
| 55 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 56 | // ecp_nistz256_from_mont sets |res| to |in|, converted from Montgomery domain |
| 57 | // by multiplying with 1. |
Steven Valdez | b0b45c6 | 2017-01-17 16:23:54 -0500 | [diff] [blame] | 58 | static inline void ecp_nistz256_from_mont(BN_ULONG res[P256_LIMBS], |
| 59 | const BN_ULONG in[P256_LIMBS]) { |
| 60 | static const BN_ULONG ONE[P256_LIMBS] = { 1 }; |
| 61 | ecp_nistz256_mul_mont(res, in, ONE); |
| 62 | } |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 63 | |
| 64 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 65 | // P-256 point operations. |
| 66 | // |
| 67 | // The following functions may be used in-place. All coordinates are in the |
| 68 | // Montgomery domain. |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 69 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 70 | // A P256_POINT represents a P-256 point in Jacobian coordinates. |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 71 | typedef struct { |
| 72 | BN_ULONG X[P256_LIMBS]; |
| 73 | BN_ULONG Y[P256_LIMBS]; |
| 74 | BN_ULONG Z[P256_LIMBS]; |
| 75 | } P256_POINT; |
| 76 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 77 | // A P256_POINT_AFFINE represents a P-256 point in affine coordinates. Infinity |
| 78 | // is encoded as (0, 0). |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 79 | typedef struct { |
| 80 | BN_ULONG X[P256_LIMBS]; |
| 81 | BN_ULONG Y[P256_LIMBS]; |
| 82 | } P256_POINT_AFFINE; |
| 83 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 84 | // ecp_nistz256_select_w5 sets |*val| to |in_t[index-1]| if 1 <= |index| <= 16 |
| 85 | // and all zeros (the point at infinity) if |index| is 0. This is done in |
| 86 | // constant time. |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 87 | void ecp_nistz256_select_w5(P256_POINT *val, const P256_POINT in_t[16], |
| 88 | int index); |
| 89 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 90 | // ecp_nistz256_select_w7 sets |*val| to |in_t[index-1]| if 1 <= |index| <= 64 |
| 91 | // and all zeros (the point at infinity) if |index| is 0. This is done in |
| 92 | // constant time. |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 93 | void ecp_nistz256_select_w7(P256_POINT_AFFINE *val, |
| 94 | const P256_POINT_AFFINE in_t[64], int index); |
| 95 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 96 | // ecp_nistz256_point_double sets |r| to |a| doubled. |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 97 | void ecp_nistz256_point_double(P256_POINT *r, const P256_POINT *a); |
| 98 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 99 | // ecp_nistz256_point_add adds |a| to |b| and places the result in |r|. |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 100 | void ecp_nistz256_point_add(P256_POINT *r, const P256_POINT *a, |
| 101 | const P256_POINT *b); |
| 102 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 103 | // ecp_nistz256_point_add_affine adds |a| to |b| and places the result in |
| 104 | // |r|. |a| and |b| must not represent the same point unless they are both |
| 105 | // infinity. |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 106 | void ecp_nistz256_point_add_affine(P256_POINT *r, const P256_POINT *a, |
| 107 | const P256_POINT_AFFINE *b); |
| 108 | |
| 109 | #endif /* !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && \ |
| 110 | !defined(OPENSSL_SMALL) */ |
| 111 | |
| 112 | |
| 113 | #if defined(__cplusplus) |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 114 | } // extern C++ |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 115 | #endif |
| 116 | |
Robert Sloan | 8f860b1 | 2017-08-28 07:37:06 -0700 | [diff] [blame] | 117 | #endif // OPENSSL_HEADER_EC_P256_X86_64_H |