]>
git.gir.st - tmk_keyboard.git/blob - tmk_core/tool/mbed/mbed-sdk/libraries/net/https/axTLS/crypto/bigint.c
2 * Copyright (c) 2007, Cameron Rich
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions are met:
9 * * Redistributions of source code must retain the above copyright notice,
10 * this list of conditions and the following disclaimer.
11 * * Redistributions in binary form must reproduce the above copyright notice,
12 * this list of conditions and the following disclaimer in the documentation
13 * and/or other materials provided with the distribution.
14 * * Neither the name of the axTLS project nor the names of its contributors
15 * may be used to endorse or promote products derived from this software
16 * without specific prior written permission.
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
21 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
22 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
23 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
24 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
25 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
26 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
27 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
28 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 * @defgroup bigint_api Big Integer API
33 * @brief The bigint implementation as used by the axTLS project.
35 * The bigint library is for RSA encryption/decryption as well as signing.
36 * This code tries to minimise use of malloc/free by maintaining a small
37 * cache. A bigint context may maintain state by being made "permanent".
38 * It be be later released with a bi_depermanent() and bi_free() call.
40 * It supports the following reduction techniques:
45 * It also implements the following:
46 * - Karatsuba multiplication
48 * - Sliding window exponentiation
49 * - Chinese Remainder Theorem (implemented in rsa.c).
51 * All the algorithms used are pretty standard, and designed for different
52 * data bus sizes. Negative numbers are not dealt with at all, so a subtraction
53 * may need to be tested for negativity.
55 * This library steals some ideas from Jef Poskanzer
56 * <http://cs.marlboro.edu/term/cs-fall02/algorithms/crypto/RSA/bigint>
57 * and GMP <http://www.swox.com/gmp>. It gets most of its implementation
58 * detail from "The Handbook of Applied Cryptography"
59 * <http://www.cacr.math.uwaterloo.ca/hac/about/chap14.pdf>
71 #define V1 v->comps[v->size-1] /**< v1 for division */
72 #define V2 v->comps[v->size-2] /**< v2 for division */
73 #define U(j) tmp_u->comps[tmp_u->size-j-1] /**< uj for division */
74 #define Q(j) quotient->comps[quotient->size-j-1] /**< qj for division */
76 static bigint
*bi_int_multiply(BI_CTX
*ctx
, bigint
*bi
, comp i
);
77 static bigint
*bi_int_divide(BI_CTX
*ctx
, bigint
*biR
, comp denom
);
78 static bigint
*alloc(BI_CTX
*ctx
, int size
);
79 static bigint
*trim(bigint
*bi
);
80 static void more_comps(bigint
*bi
, int n
);
81 #if defined(CONFIG_BIGINT_KARATSUBA) || defined(CONFIG_BIGINT_BARRETT) || \
82 defined(CONFIG_BIGINT_MONTGOMERY)
83 static bigint
*comp_right_shift(bigint
*biR
, int num_shifts
);
84 static bigint
*comp_left_shift(bigint
*biR
, int num_shifts
);
87 #ifdef CONFIG_BIGINT_CHECK_ON
88 static void check(const bigint
*bi
);
90 #define check(A) /**< disappears in normal production mode */
95 * @brief Start a new bigint context.
96 * @return A bigint context.
98 BI_CTX
*bi_initialize(void)
100 /* calloc() sets everything to zero */
101 BI_CTX
*ctx
= (BI_CTX
*)calloc(1, sizeof(BI_CTX
));
104 ctx
->bi_radix
= alloc(ctx
, 2);
105 ctx
->bi_radix
->comps
[0] = 0;
106 ctx
->bi_radix
->comps
[1] = 1;
107 bi_permanent(ctx
->bi_radix
);
112 * @brief Close the bigint context and free any resources.
114 * Free up any used memory - a check is done if all objects were not
116 * @param ctx [in] The bigint session context.
118 void bi_terminate(BI_CTX
*ctx
)
120 bi_depermanent(ctx
->bi_radix
);
121 bi_free(ctx
, ctx
->bi_radix
);
123 if (ctx
->active_count
!= 0)
125 #ifdef CONFIG_SSL_FULL_MODE
126 printf("bi_terminate: there were %d un-freed bigints\n",
137 *@brief Clear the memory cache.
139 void bi_clear_cache(BI_CTX
*ctx
)
143 if (ctx
->free_list
== NULL
)
146 for (p
= ctx
->free_list
; p
!= NULL
; p
= pn
)
154 ctx
->free_list
= NULL
;
158 * @brief Increment the number of references to this object.
159 * It does not do a full copy.
160 * @param bi [in] The bigint to copy.
161 * @return A reference to the same bigint.
163 bigint
*bi_copy(bigint
*bi
)
166 if (bi
->refs
!= PERMANENT
)
172 * @brief Simply make a bigint object "unfreeable" if bi_free() is called on it.
174 * For this object to be freed, bi_depermanent() must be called.
175 * @param bi [in] The bigint to be made permanent.
177 void bi_permanent(bigint
*bi
)
182 #ifdef CONFIG_SSL_FULL_MODE
183 printf("bi_permanent: refs was not 1\n");
188 bi
->refs
= PERMANENT
;
192 * @brief Take a permanent object and make it eligible for freedom.
193 * @param bi [in] The bigint to be made back to temporary.
195 void bi_depermanent(bigint
*bi
)
198 if (bi
->refs
!= PERMANENT
)
200 #ifdef CONFIG_SSL_FULL_MODE
201 printf("bi_depermanent: bigint was not permanent\n");
210 * @brief Free a bigint object so it can be used again.
212 * The memory itself it not actually freed, just tagged as being available
213 * @param ctx [in] The bigint session context.
214 * @param bi [in] The bigint to be freed.
216 void bi_free(BI_CTX
*ctx
, bigint
*bi
)
219 if (bi
->refs
== PERMANENT
)
229 bi
->next
= ctx
->free_list
;
233 if (--ctx
->active_count
< 0)
235 #ifdef CONFIG_SSL_FULL_MODE
236 printf("bi_free: active_count went negative "
237 "- double-freed bigint?\n");
244 * @brief Convert an (unsigned) integer into a bigint.
245 * @param ctx [in] The bigint session context.
246 * @param i [in] The (unsigned) integer to be converted.
249 bigint
*int_to_bi(BI_CTX
*ctx
, comp i
)
251 bigint
*biR
= alloc(ctx
, 1);
257 * @brief Do a full copy of the bigint object.
258 * @param ctx [in] The bigint session context.
259 * @param bi [in] The bigint object to be copied.
261 bigint
*bi_clone(BI_CTX
*ctx
, const bigint
*bi
)
263 bigint
*biR
= alloc(ctx
, bi
->size
);
265 memcpy(biR
->comps
, bi
->comps
, bi
->size
*COMP_BYTE_SIZE
);
270 * @brief Perform an addition operation between two bigints.
271 * @param ctx [in] The bigint session context.
272 * @param bia [in] A bigint.
273 * @param bib [in] Another bigint.
274 * @return The result of the addition.
276 bigint
*bi_add(BI_CTX
*ctx
, bigint
*bia
, bigint
*bib
)
285 n
= max(bia
->size
, bib
->size
);
286 more_comps(bia
, n
+1);
297 carry
= cy1
| (rl
< sl
);
301 *pa
= carry
; /* do overflow */
307 * @brief Perform a subtraction operation between two bigints.
308 * @param ctx [in] The bigint session context.
309 * @param bia [in] A bigint.
310 * @param bib [in] Another bigint.
311 * @param is_negative [out] If defined, indicates that the result was negative.
312 * is_negative may be null.
313 * @return The result of the subtraction. The result is always positive.
315 bigint
*bi_subtract(BI_CTX
*ctx
,
316 bigint
*bia
, bigint
*bib
, int *is_negative
)
319 comp
*pa
, *pb
, carry
= 0;
333 carry
= cy1
| (rl
> sl
);
337 if (is_negative
) /* indicate a negative result */
339 *is_negative
= carry
;
342 bi_free(ctx
, trim(bib
)); /* put bib back to the way it was */
347 * Perform a multiply between a bigint an an (unsigned) integer
349 static bigint
*bi_int_multiply(BI_CTX
*ctx
, bigint
*bia
, comp b
)
351 int j
= 0, n
= bia
->size
;
352 bigint
*biR
= alloc(ctx
, n
+ 1);
354 comp
*r
= biR
->comps
;
355 comp
*a
= bia
->comps
;
359 /* clear things to start with */
360 memset(r
, 0, ((n
+1)*COMP_BYTE_SIZE
));
364 long_comp tmp
= *r
+ (long_comp
)a
[j
]*b
+ carry
;
365 *r
++ = (comp
)tmp
; /* downsize */
366 carry
= (comp
)(tmp
>> COMP_BIT_SIZE
);
375 * @brief Does both division and modulo calculations.
377 * Used extensively when doing classical reduction.
378 * @param ctx [in] The bigint session context.
379 * @param u [in] A bigint which is the numerator.
380 * @param v [in] Either the denominator or the modulus depending on the mode.
381 * @param is_mod [n] Determines if this is a normal division (0) or a reduction
383 * @return The result of the division/reduction.
385 bigint
*bi_divide(BI_CTX
*ctx
, bigint
*u
, bigint
*v
, int is_mod
)
387 int n
= v
->size
, m
= u
->size
-n
;
388 int j
= 0, orig_u_size
= u
->size
;
389 uint8_t mod_offset
= ctx
->mod_offset
;
391 bigint
*quotient
, *tmp_u
;
397 /* if doing reduction and we are < mod, then return mod */
398 if (is_mod
&& bi_compare(v
, u
) > 0)
404 quotient
= alloc(ctx
, m
+1);
405 tmp_u
= alloc(ctx
, n
+1);
406 v
= trim(v
); /* make sure we have no leading 0's */
407 d
= (comp
)((long_comp
)COMP_RADIX
/(V1
+1));
409 /* clear things to start with */
410 memset(quotient
->comps
, 0, ((quotient
->size
)*COMP_BYTE_SIZE
));
415 u
= bi_int_multiply(ctx
, u
, d
);
419 v
= ctx
->bi_normalised_mod
[mod_offset
];
423 v
= bi_int_multiply(ctx
, v
, d
);
427 if (orig_u_size
== u
->size
) /* new digit position u0 */
429 more_comps(u
, orig_u_size
+ 1);
434 /* get a temporary short version of u */
435 memcpy(tmp_u
->comps
, &u
->comps
[u
->size
-n
-1-j
], (n
+1)*COMP_BYTE_SIZE
);
440 q_dash
= COMP_RADIX
-1;
444 q_dash
= (comp
)(((long_comp
)U(0)*COMP_RADIX
+ U(1))/V1
);
446 if (v
->size
> 1 && V2
)
448 /* we are implementing the following:
449 if (V2*q_dash > (((U(0)*COMP_RADIX + U(1) -
450 q_dash*V1)*COMP_RADIX) + U(2))) ... */
451 comp inner
= (comp
)((long_comp
)COMP_RADIX
*U(0) + U(1) -
452 (long_comp
)q_dash
*V1
);
453 if ((long_comp
)V2
*q_dash
> (long_comp
)inner
*COMP_RADIX
+ U(2))
460 /* multiply and subtract */
464 tmp_u
= bi_subtract(ctx
, tmp_u
,
465 bi_int_multiply(ctx
, bi_copy(v
), q_dash
), &is_negative
);
466 more_comps(tmp_u
, n
+1);
474 tmp_u
= bi_add(ctx
, tmp_u
, bi_copy(v
));
476 /* lop off the carry */
487 memcpy(&u
->comps
[u
->size
-n
-1-j
], tmp_u
->comps
, (n
+1)*COMP_BYTE_SIZE
);
493 if (is_mod
) /* get the remainder */
495 bi_free(ctx
, quotient
);
496 return bi_int_divide(ctx
, trim(u
), d
);
498 else /* get the quotient */
501 return trim(quotient
);
506 * Perform an integer divide on a bigint.
508 static bigint
*bi_int_divide(BI_CTX
*ctx
, bigint
*biR
, comp denom
)
510 int i
= biR
->size
- 1;
517 r
= (r
<<COMP_BIT_SIZE
) + biR
->comps
[i
];
518 biR
->comps
[i
] = (comp
)(r
/ denom
);
525 #ifdef CONFIG_BIGINT_MONTGOMERY
527 * There is a need for the value of integer N' such that B^-1(B-1)-N^-1N'=1,
528 * where B^-1(B-1) mod N=1. Actually, only the least significant part of
529 * N' is needed, hence the definition N0'=N' mod b. We reproduce below the
530 * simple algorithm from an article by Dusse and Kaliski to efficiently
531 * find N0' from N0 and b */
532 static comp
modular_inverse(bigint
*bim
)
536 comp two_2_i_minus_1
= 2; /* 2^(i-1) */
537 long_comp two_2_i
= 4; /* 2^i */
538 comp N
= bim
->comps
[0];
540 for (i
= 2; i
<= COMP_BIT_SIZE
; i
++)
542 if ((long_comp
)N
*t
%two_2_i
>= two_2_i_minus_1
)
544 t
+= two_2_i_minus_1
;
547 two_2_i_minus_1
<<= 1;
551 return (comp
)(COMP_RADIX
-t
);
555 #if defined(CONFIG_BIGINT_KARATSUBA) || defined(CONFIG_BIGINT_BARRETT) || \
556 defined(CONFIG_BIGINT_MONTGOMERY)
558 * Take each component and shift down (in terms of components)
560 static bigint
*comp_right_shift(bigint
*biR
, int num_shifts
)
562 int i
= biR
->size
-num_shifts
;
563 comp
*x
= biR
->comps
;
564 comp
*y
= &biR
->comps
[num_shifts
];
568 if (i
<= 0) /* have we completely right shifted? */
570 biR
->comps
[0] = 0; /* return 0 */
580 biR
->size
-= num_shifts
;
585 * Take each component and shift it up (in terms of components)
587 static bigint
*comp_left_shift(bigint
*biR
, int num_shifts
)
599 more_comps(biR
, biR
->size
+ num_shifts
);
601 x
= &biR
->comps
[i
+num_shifts
];
609 memset(biR
->comps
, 0, num_shifts
*COMP_BYTE_SIZE
); /* zero LS comps */
615 * @brief Allow a binary sequence to be imported as a bigint.
616 * @param ctx [in] The bigint session context.
617 * @param data [in] The data to be converted.
618 * @param size [in] The number of bytes of data.
619 * @return A bigint representing this data.
621 bigint
*bi_import(BI_CTX
*ctx
, const uint8_t *data
, int size
)
623 bigint
*biR
= alloc(ctx
, (size
+COMP_BYTE_SIZE
-1)/COMP_BYTE_SIZE
);
624 int i
, j
= 0, offset
= 0;
626 memset(biR
->comps
, 0, biR
->size
*COMP_BYTE_SIZE
);
628 for (i
= size
-1; i
>= 0; i
--)
630 biR
->comps
[offset
] += data
[i
] << (j
*8);
632 if (++j
== COMP_BYTE_SIZE
)
642 #ifdef CONFIG_SSL_FULL_MODE
644 * @brief The testharness uses this code to import text hex-streams and
645 * convert them into bigints.
646 * @param ctx [in] The bigint session context.
647 * @param data [in] A string consisting of hex characters. The characters must
649 * @return A bigint representing this data.
651 bigint
*bi_str_import(BI_CTX
*ctx
, const char *data
)
653 int size
= strlen(data
);
654 bigint
*biR
= alloc(ctx
, (size
+COMP_NUM_NIBBLES
-1)/COMP_NUM_NIBBLES
);
655 int i
, j
= 0, offset
= 0;
656 memset(biR
->comps
, 0, biR
->size
*COMP_BYTE_SIZE
);
658 for (i
= size
-1; i
>= 0; i
--)
660 int num
= (data
[i
] <= '9') ? (data
[i
] - '0') : (data
[i
] - 'A' + 10);
661 biR
->comps
[offset
] += num
<< (j
*4);
663 if (++j
== COMP_NUM_NIBBLES
)
673 void bi_print(const char *label
, bigint
*x
)
679 printf("%s: (null)\n", label
);
683 printf("%s: (size %d)\n", label
, x
->size
);
684 for (i
= x
->size
-1; i
>= 0; i
--)
686 for (j
= COMP_NUM_NIBBLES
-1; j
>= 0; j
--)
688 comp mask
= 0x0f << (j
*4);
689 comp num
= (x
->comps
[i
] & mask
) >> (j
*4);
690 putc((num
<= 9) ? (num
+ '0') : (num
+ 'A' - 10), stdout
);
699 * @brief Take a bigint and convert it into a byte sequence.
701 * This is useful after a decrypt operation.
702 * @param ctx [in] The bigint session context.
703 * @param x [in] The bigint to be converted.
704 * @param data [out] The converted data as a byte stream.
705 * @param size [in] The maximum size of the byte stream. Unused bytes will be
708 void bi_export(BI_CTX
*ctx
, bigint
*x
, uint8_t *data
, int size
)
710 int i
, j
, k
= size
-1;
713 memset(data
, 0, size
); /* ensure all leading 0's are cleared */
715 for (i
= 0; i
< x
->size
; i
++)
717 for (j
= 0; j
< COMP_BYTE_SIZE
; j
++)
719 comp mask
= 0xff << (j
*8);
720 int num
= (x
->comps
[i
] & mask
) >> (j
*8);
735 * @brief Pre-calculate some of the expensive steps in reduction.
737 * This function should only be called once (normally when a session starts).
738 * When the session is over, bi_free_mod() should be called. bi_mod_power()
739 * relies on this function being called.
740 * @param ctx [in] The bigint session context.
741 * @param bim [in] The bigint modulus that will be used.
742 * @param mod_offset [in] There are three moduluii that can be stored - the
743 * standard modulus, and its two primes p and q. This offset refers to which
744 * modulus we are referring to.
745 * @see bi_free_mod(), bi_mod_power().
747 void bi_set_mod(BI_CTX
*ctx
, bigint
*bim
, int mod_offset
)
750 comp d
= (comp
)((long_comp
)COMP_RADIX
/(bim
->comps
[k
-1]+1));
751 #ifdef CONFIG_BIGINT_MONTGOMERY
755 ctx
->bi_mod
[mod_offset
] = bim
;
756 bi_permanent(ctx
->bi_mod
[mod_offset
]);
757 ctx
->bi_normalised_mod
[mod_offset
] = bi_int_multiply(ctx
, bim
, d
);
758 bi_permanent(ctx
->bi_normalised_mod
[mod_offset
]);
760 #if defined(CONFIG_BIGINT_MONTGOMERY)
761 /* set montgomery variables */
762 R
= comp_left_shift(bi_clone(ctx
, ctx
->bi_radix
), k
-1); /* R */
763 R2
= comp_left_shift(bi_clone(ctx
, ctx
->bi_radix
), k
*2-1); /* R^2 */
764 ctx
->bi_RR_mod_m
[mod_offset
] = bi_mod(ctx
, R2
); /* R^2 mod m */
765 ctx
->bi_R_mod_m
[mod_offset
] = bi_mod(ctx
, R
); /* R mod m */
767 bi_permanent(ctx
->bi_RR_mod_m
[mod_offset
]);
768 bi_permanent(ctx
->bi_R_mod_m
[mod_offset
]);
770 ctx
->N0_dash
[mod_offset
] = modular_inverse(ctx
->bi_mod
[mod_offset
]);
772 #elif defined (CONFIG_BIGINT_BARRETT)
773 ctx
->bi_mu
[mod_offset
] =
774 bi_divide(ctx
, comp_left_shift(
775 bi_clone(ctx
, ctx
->bi_radix
), k
*2-1), ctx
->bi_mod
[mod_offset
], 0);
776 bi_permanent(ctx
->bi_mu
[mod_offset
]);
781 * @brief Used when cleaning various bigints at the end of a session.
782 * @param ctx [in] The bigint session context.
783 * @param mod_offset [in] The offset to use.
786 void bi_free_mod(BI_CTX
*ctx
, int mod_offset
)
788 bi_depermanent(ctx
->bi_mod
[mod_offset
]);
789 bi_free(ctx
, ctx
->bi_mod
[mod_offset
]);
790 #if defined (CONFIG_BIGINT_MONTGOMERY)
791 bi_depermanent(ctx
->bi_RR_mod_m
[mod_offset
]);
792 bi_depermanent(ctx
->bi_R_mod_m
[mod_offset
]);
793 bi_free(ctx
, ctx
->bi_RR_mod_m
[mod_offset
]);
794 bi_free(ctx
, ctx
->bi_R_mod_m
[mod_offset
]);
795 #elif defined(CONFIG_BIGINT_BARRETT)
796 bi_depermanent(ctx
->bi_mu
[mod_offset
]);
797 bi_free(ctx
, ctx
->bi_mu
[mod_offset
]);
799 bi_depermanent(ctx
->bi_normalised_mod
[mod_offset
]);
800 bi_free(ctx
, ctx
->bi_normalised_mod
[mod_offset
]);
804 * Perform a standard multiplication between two bigints.
806 * Barrett reduction has no need for some parts of the product, so ignore bits
807 * of the multiply. This routine gives Barrett its big performance
808 * improvements over Classical/Montgomery reduction methods.
810 static bigint
*regular_multiply(BI_CTX
*ctx
, bigint
*bia
, bigint
*bib
,
811 int inner_partial
, int outer_partial
)
816 bigint
*biR
= alloc(ctx
, n
+ t
);
817 comp
*sr
= biR
->comps
;
818 comp
*sa
= bia
->comps
;
819 comp
*sb
= bib
->comps
;
824 /* clear things to start with */
825 memset(biR
->comps
, 0, ((n
+t
)*COMP_BYTE_SIZE
));
834 if (outer_partial
&& outer_partial
-i
> 0 && outer_partial
< n
)
836 r_index
= outer_partial
-1;
837 j
= outer_partial
-i
-1;
842 if (inner_partial
&& r_index
>= inner_partial
)
847 tmp
= sr
[r_index
] + ((long_comp
)sa
[j
])*sb
[i
] + carry
;
848 sr
[r_index
++] = (comp
)tmp
; /* downsize */
849 carry
= tmp
>> COMP_BIT_SIZE
;
860 #ifdef CONFIG_BIGINT_KARATSUBA
862 * Karatsuba improves on regular multiplication due to only 3 multiplications
863 * being done instead of 4. The additional additions/subtractions are O(N)
864 * rather than O(N^2) and so for big numbers it saves on a few operations
866 static bigint
*karatsuba(BI_CTX
*ctx
, bigint
*bia
, bigint
*bib
, int is_square
)
869 bigint
*p0
, *p1
, *p2
;
874 m
= (bia
->size
+ 1)/2;
878 m
= (max(bia
->size
, bib
->size
) + 1)/2;
881 x0
= bi_clone(ctx
, bia
);
883 x1
= bi_clone(ctx
, bia
);
884 comp_right_shift(x1
, m
);
887 /* work out the 3 partial products */
890 p0
= bi_square(ctx
, bi_copy(x0
));
891 p2
= bi_square(ctx
, bi_copy(x1
));
892 p1
= bi_square(ctx
, bi_add(ctx
, x0
, x1
));
894 else /* normal multiply */
897 y0
= bi_clone(ctx
, bib
);
899 y1
= bi_clone(ctx
, bib
);
900 comp_right_shift(y1
, m
);
903 p0
= bi_multiply(ctx
, bi_copy(x0
), bi_copy(y0
));
904 p2
= bi_multiply(ctx
, bi_copy(x1
), bi_copy(y1
));
905 p1
= bi_multiply(ctx
, bi_add(ctx
, x0
, x1
), bi_add(ctx
, y0
, y1
));
908 p1
= bi_subtract(ctx
,
909 bi_subtract(ctx
, p1
, bi_copy(p2
), NULL
), bi_copy(p0
), NULL
);
911 comp_left_shift(p1
, m
);
912 comp_left_shift(p2
, 2*m
);
913 return bi_add(ctx
, p1
, bi_add(ctx
, p0
, p2
));
918 * @brief Perform a multiplication operation between two bigints.
919 * @param ctx [in] The bigint session context.
920 * @param bia [in] A bigint.
921 * @param bib [in] Another bigint.
922 * @return The result of the multiplication.
924 bigint
*bi_multiply(BI_CTX
*ctx
, bigint
*bia
, bigint
*bib
)
929 #ifdef CONFIG_BIGINT_KARATSUBA
930 if (min(bia
->size
, bib
->size
) < MUL_KARATSUBA_THRESH
)
932 return regular_multiply(ctx
, bia
, bib
, 0, 0);
935 return karatsuba(ctx
, bia
, bib
, 0);
937 return regular_multiply(ctx
, bia
, bib
, 0, 0);
941 #ifdef CONFIG_BIGINT_SQUARE
943 * Perform the actual square operion. It takes into account overflow.
945 static bigint
*regular_square(BI_CTX
*ctx
, bigint
*bi
)
949 bigint
*biR
= alloc(ctx
, t
*2+1);
950 comp
*w
= biR
->comps
;
953 memset(w
, 0, biR
->size
*COMP_BYTE_SIZE
);
957 long_comp tmp
= w
[2*i
] + (long_comp
)x
[i
]*x
[i
];
959 carry
= tmp
>> COMP_BIT_SIZE
;
961 for (j
= i
+1; j
< t
; j
++)
964 long_comp xx
= (long_comp
)x
[i
]*x
[j
];
965 if ((COMP_MAX
-xx
) < xx
)
970 if ((COMP_MAX
-tmp
) < w
[i
+j
])
975 if ((COMP_MAX
-tmp
) < carry
)
980 carry
= tmp
>> COMP_BIT_SIZE
;
986 tmp
= w
[i
+t
] + carry
;
988 w
[i
+t
+1] = tmp
>> COMP_BIT_SIZE
;
996 * @brief Perform a square operation on a bigint.
997 * @param ctx [in] The bigint session context.
998 * @param bia [in] A bigint.
999 * @return The result of the multiplication.
1001 bigint
*bi_square(BI_CTX
*ctx
, bigint
*bia
)
1005 #ifdef CONFIG_BIGINT_KARATSUBA
1006 if (bia
->size
< SQU_KARATSUBA_THRESH
)
1008 return regular_square(ctx
, bia
);
1011 return karatsuba(ctx
, bia
, NULL
, 1);
1013 return regular_square(ctx
, bia
);
1019 * @brief Compare two bigints.
1020 * @param bia [in] A bigint.
1021 * @param bib [in] Another bigint.
1022 * @return -1 if smaller, 1 if larger and 0 if equal.
1024 int bi_compare(bigint
*bia
, bigint
*bib
)
1031 if (bia
->size
> bib
->size
)
1033 else if (bia
->size
< bib
->size
)
1037 comp
*a
= bia
->comps
;
1038 comp
*b
= bib
->comps
;
1040 /* Same number of components. Compare starting from the high end
1041 * and working down. */
1052 else if (a
[i
] < b
[i
])
1064 * Allocate and zero more components. Does not consume bi.
1066 static void more_comps(bigint
*bi
, int n
)
1068 if (n
> bi
->max_comps
)
1070 bi
->max_comps
= max(bi
->max_comps
* 2, n
);
1071 bi
->comps
= (comp
*)realloc(bi
->comps
, bi
->max_comps
* COMP_BYTE_SIZE
);
1076 memset(&bi
->comps
[bi
->size
], 0, (n
-bi
->size
)*COMP_BYTE_SIZE
);
1083 * Make a new empty bigint. It may just use an old one if one is available.
1084 * Otherwise get one off the heap.
1086 static bigint
*alloc(BI_CTX
*ctx
, int size
)
1090 /* Can we recycle an old bigint? */
1091 if (ctx
->free_list
!= NULL
)
1093 biR
= ctx
->free_list
;
1094 ctx
->free_list
= biR
->next
;
1099 #ifdef CONFIG_SSL_FULL_MODE
1100 printf("alloc: refs was not 0\n");
1102 abort(); /* create a stack trace from a core dump */
1105 more_comps(biR
, size
);
1109 /* No free bigints available - create a new one. */
1110 biR
= (bigint
*)malloc(sizeof(bigint
));
1111 biR
->comps
= (comp
*)malloc(size
* COMP_BYTE_SIZE
);
1112 biR
->max_comps
= size
; /* give some space to spare */
1118 ctx
->active_count
++;
1123 * Work out the highest '1' bit in an exponent. Used when doing sliding-window
1126 static int find_max_exp_index(bigint
*biexp
)
1128 int i
= COMP_BIT_SIZE
-1;
1129 comp shift
= COMP_RADIX
/2;
1130 comp test
= biexp
->comps
[biexp
->size
-1]; /* assume no leading zeroes */
1138 return i
+(biexp
->size
-1)*COMP_BIT_SIZE
;
1144 return -1; /* error - must have been a leading 0 */
1148 * Is a particular bit is an exponent 1 or 0? Used when doing sliding-window
1151 static int exp_bit_is_one(bigint
*biexp
, int offset
)
1153 comp test
= biexp
->comps
[offset
/ COMP_BIT_SIZE
];
1154 int num_shifts
= offset
% COMP_BIT_SIZE
;
1160 for (i
= 0; i
< num_shifts
; i
++)
1165 return (test
& shift
) != 0;
1168 #ifdef CONFIG_BIGINT_CHECK_ON
1170 * Perform a sanity check on bi.
1172 static void check(const bigint
*bi
)
1176 printf("check: zero or negative refs in bigint\n");
1180 if (bi
->next
!= NULL
)
1182 printf("check: attempt to use a bigint from "
1190 * Delete any leading 0's (and allow for 0).
1192 static bigint
*trim(bigint
*bi
)
1196 while (bi
->comps
[bi
->size
-1] == 0 && bi
->size
> 1)
1204 #if defined(CONFIG_BIGINT_MONTGOMERY)
1206 * @brief Perform a single montgomery reduction.
1207 * @param ctx [in] The bigint session context.
1208 * @param bixy [in] A bigint.
1209 * @return The result of the montgomery reduction.
1211 bigint
*bi_mont(BI_CTX
*ctx
, bigint
*bixy
)
1214 uint8_t mod_offset
= ctx
->mod_offset
;
1215 bigint
*bim
= ctx
->bi_mod
[mod_offset
];
1216 comp mod_inv
= ctx
->N0_dash
[mod_offset
];
1220 if (ctx
->use_classical
) /* just use classical instead */
1222 return bi_mod(ctx
, bixy
);
1229 bixy
= bi_add(ctx
, bixy
, comp_left_shift(
1230 bi_int_multiply(ctx
, bim
, bixy
->comps
[i
]*mod_inv
), i
));
1233 comp_right_shift(bixy
, n
);
1235 if (bi_compare(bixy
, bim
) >= 0)
1237 bixy
= bi_subtract(ctx
, bixy
, bim
, NULL
);
1243 #elif defined(CONFIG_BIGINT_BARRETT)
1245 * Stomp on the most significant components to give the illusion of a "mod base
1248 static bigint
*comp_mod(bigint
*bi
, int mod
)
1261 * @brief Perform a single Barrett reduction.
1262 * @param ctx [in] The bigint session context.
1263 * @param bi [in] A bigint.
1264 * @return The result of the Barrett reduction.
1266 bigint
*bi_barrett(BI_CTX
*ctx
, bigint
*bi
)
1269 bigint
*q1
, *q2
, *q3
, *r1
, *r2
, *r
;
1270 uint8_t mod_offset
= ctx
->mod_offset
;
1271 bigint
*bim
= ctx
->bi_mod
[mod_offset
];
1277 /* use Classical method instead - Barrett cannot help here */
1281 return bi_mod(ctx
, bi
);
1283 bigint
* a
= bi_clone(ctx
, bi
);
1284 q1
= comp_right_shift(a
, k
-1);
1286 /* do outer partial multiply */
1287 q2
= regular_multiply(ctx
, q1
, ctx
->bi_mu
[mod_offset
], 0, k
-1);
1288 q3
= comp_right_shift(q2
, k
+1);
1289 r1
= comp_mod(bi
, k
+1);
1291 /* do inner partial multiply */
1292 r2
= comp_mod(regular_multiply(ctx
, q3
, bim
, k
+1, 0), k
+1);
1293 r
= bi_subtract(ctx
, r1
, r2
, NULL
);
1295 /* if (r >= m) r = r - m; */
1296 if (bi_compare(r
, bim
) >= 0)
1299 r
= bi_subtract(ctx
, r
, bim
, NULL
);
1304 #endif /* CONFIG_BIGINT_BARRETT */
1306 #ifdef CONFIG_BIGINT_SLIDING_WINDOW
1308 * Work out g1, g3, g5, g7... etc for the sliding-window algorithm
1310 static void precompute_slide_window(BI_CTX
*ctx
, int window
, bigint
*g1
)
1315 for (i
= 0; i
< window
-1; i
++) /* compute 2^(window-1) */
1320 ctx
->g
= (bigint
**)malloc(k
*sizeof(bigint
*));
1321 ctx
->g
[0] = bi_clone(ctx
, g1
);
1322 bi_permanent(ctx
->g
[0]);
1323 g2
= bi_residue(ctx
, bi_square(ctx
, ctx
->g
[0])); /* g^2 */
1325 for (i
= 1; i
< k
; i
++)
1327 ctx
->g
[i
] = bi_residue(ctx
, bi_multiply(ctx
, ctx
->g
[i
-1], bi_copy(g2
)));
1328 bi_permanent(ctx
->g
[i
]);
1337 * @brief Perform a modular exponentiation.
1339 * This function requires bi_set_mod() to have been called previously. This is
1340 * one of the optimisations used for performance.
1341 * @param ctx [in] The bigint session context.
1342 * @param bi [in] The bigint on which to perform the mod power operation.
1343 * @param biexp [in] The bigint exponent.
1344 * @return The result of the mod exponentiation operation
1345 * @see bi_set_mod().
1347 bigint
*bi_mod_power(BI_CTX
*ctx
, bigint
*bi
, bigint
*biexp
)
1349 int i
= find_max_exp_index(biexp
), j
, window_size
= 1;
1350 bigint
*biR
= int_to_bi(ctx
, 1);
1353 #if defined(CONFIG_BIGINT_MONTGOMERY)
1354 uint8_t mod_offset
= ctx
->mod_offset
;
1355 if (!ctx
->use_classical
)
1359 bi_multiply(ctx
, bi
, ctx
->bi_RR_mod_m
[mod_offset
])); /* x' */
1361 biR
= ctx
->bi_R_mod_m
[mod_offset
]; /* A */
1368 #ifdef CONFIG_BIGINT_SLIDING_WINDOW
1369 for (j
= i
; j
> 32; j
/= 5) /* work out an optimum size */
1372 /* work out the slide constants */
1373 precompute_slide_window(ctx
, window_size
, bi
);
1374 #else /* just one constant */
1375 ctx
->g
= (bigint
**)malloc(sizeof(bigint
*));
1376 ctx
->g
[0] = bi_clone(ctx
, bi
);
1378 bi_permanent(ctx
->g
[0]);
1381 /* if sliding-window is off, then only one bit will be done at a time and
1382 * will reduce to standard left-to-right exponentiation */
1385 if (exp_bit_is_one(biexp
, i
))
1387 int l
= i
-window_size
+1;
1390 if (l
< 0) /* LSB of exponent will always be 1 */
1394 while (exp_bit_is_one(biexp
, l
) == 0)
1395 l
++; /* go back up */
1397 /* build up the section of the exponent */
1398 for (j
= i
; j
>= l
; j
--)
1400 biR
= bi_residue(ctx
, bi_square(ctx
, biR
));
1401 if (exp_bit_is_one(biexp
, j
))
1407 part_exp
= (part_exp
-1)/2; /* adjust for array */
1408 bigint
* a
= bi_multiply(ctx
, biR
, ctx
->g
[part_exp
]);
1409 biR
= bi_residue(ctx
, a
);
1412 else /* square it */
1414 biR
= bi_residue(ctx
, bi_square(ctx
, biR
));
1421 for (i
= 0; i
< ctx
->window
; i
++)
1423 bi_depermanent(ctx
->g
[i
]);
1424 bi_free(ctx
, ctx
->g
[i
]);
1429 bi_free(ctx
, biexp
);
1430 #if defined CONFIG_BIGINT_MONTGOMERY
1431 return ctx
->use_classical
? biR
: bi_mont(ctx
, biR
); /* convert back */
1432 #else /* CONFIG_BIGINT_CLASSICAL or CONFIG_BIGINT_BARRETT */
1437 #ifdef CONFIG_SSL_CERT_VERIFICATION
1439 * @brief Perform a modular exponentiation using a temporary modulus.
1441 * We need this function to check the signatures of certificates. The modulus
1442 * of this function is temporary as it's just used for authentication.
1443 * @param ctx [in] The bigint session context.
1444 * @param bi [in] The bigint to perform the exp/mod.
1445 * @param bim [in] The temporary modulus.
1446 * @param biexp [in] The bigint exponent.
1447 * @return The result of the mod exponentiation operation
1448 * @see bi_set_mod().
1450 bigint
*bi_mod_power2(BI_CTX
*ctx
, bigint
*bi
, bigint
*bim
, bigint
*biexp
)
1452 bigint
*biR
, *tmp_biR
;
1454 /* Set up a temporary bigint context and transfer what we need between
1455 * them. We need to do this since we want to keep the original modulus
1456 * which is already in this context. This operation is only called when
1457 * doing peer verification, and so is not expensive :-) */
1458 BI_CTX
*tmp_ctx
= bi_initialize();
1459 bi_set_mod(tmp_ctx
, bi_clone(tmp_ctx
, bim
), BIGINT_M_OFFSET
);
1460 tmp_biR
= bi_mod_power(tmp_ctx
,
1461 bi_clone(tmp_ctx
, bi
),
1462 bi_clone(tmp_ctx
, biexp
));
1463 biR
= bi_clone(ctx
, tmp_biR
);
1464 bi_free(tmp_ctx
, tmp_biR
);
1465 bi_free_mod(tmp_ctx
, BIGINT_M_OFFSET
);
1466 bi_terminate(tmp_ctx
);
1470 bi_free(ctx
, biexp
);
1475 #ifdef CONFIG_BIGINT_CRT
1477 * @brief Use the Chinese Remainder Theorem to quickly perform RSA decrypts.
1479 * @param ctx [in] The bigint session context.
1480 * @param bi [in] The bigint to perform the exp/mod.
1481 * @param dP [in] CRT's dP bigint
1482 * @param dQ [in] CRT's dQ bigint
1483 * @param p [in] CRT's p bigint
1484 * @param q [in] CRT's q bigint
1485 * @param qInv [in] CRT's qInv bigint
1486 * @return The result of the CRT operation
1488 bigint
*bi_crt(BI_CTX
*ctx
, bigint
*bi
,
1489 bigint
*dP
, bigint
*dQ
,
1490 bigint
*p
, bigint
*q
, bigint
*qInv
)
1492 bigint
*m1
, *m2
, *h
;
1494 /* Montgomery has a condition the 0 < x, y < m and these products violate
1495 * that condition. So disable Montgomery when using CRT */
1496 #if defined(CONFIG_BIGINT_MONTGOMERY)
1497 ctx
->use_classical
= 1;
1499 ctx
->mod_offset
= BIGINT_P_OFFSET
;
1500 m1
= bi_mod_power(ctx
, bi_copy(bi
), dP
);
1502 ctx
->mod_offset
= BIGINT_Q_OFFSET
;
1503 m2
= bi_mod_power(ctx
, bi
, dQ
);
1505 h
= bi_subtract(ctx
, bi_add(ctx
, m1
, p
), bi_copy(m2
), NULL
);
1506 h
= bi_multiply(ctx
, h
, qInv
);
1507 ctx
->mod_offset
= BIGINT_P_OFFSET
;
1508 h
= bi_residue(ctx
, h
);
1509 #if defined(CONFIG_BIGINT_MONTGOMERY)
1510 ctx
->use_classical
= 0; /* reset for any further operation */
1512 return bi_add(ctx
, m2
, bi_multiply(ctx
, q
, h
));