diff --git a/features/FEATURE_BLE/targets/TARGET_CORDIO_LL/thirdparty/uecc/libuECC.a b/features/FEATURE_BLE/targets/TARGET_CORDIO_LL/thirdparty/uecc/libuECC.a new file mode 100644 index 0000000000..2fe52cc720 Binary files /dev/null and b/features/FEATURE_BLE/targets/TARGET_CORDIO_LL/thirdparty/uecc/libuECC.a differ diff --git a/features/FEATURE_BLE/targets/TARGET_CORDIO_LL/thirdparty/uecc/uECC_ll.c b/features/FEATURE_BLE/targets/TARGET_CORDIO_LL/thirdparty/uecc/uECC_ll.c deleted file mode 100644 index c15cbcf1b7..0000000000 --- a/features/FEATURE_BLE/targets/TARGET_CORDIO_LL/thirdparty/uecc/uECC_ll.c +++ /dev/null @@ -1,1038 +0,0 @@ -/* Copyright 2014, Kenneth MacKay. Licensed under the BSD 2-clause license. */ - -#include -#include "uECC_ll.h" - -#ifndef uECC_PLATFORM - #if defined(__AVR__) && __AVR__ - #define uECC_PLATFORM uECC_avr - #elif defined(__thumb2__) || defined(_M_ARMT) /* I think MSVC only supports Thumb-2 targets */ - #define uECC_PLATFORM uECC_arm_thumb2 - #elif defined(__thumb__) - #define uECC_PLATFORM uECC_arm_thumb - #elif defined(__arm__) || defined(_M_ARM) - #define uECC_PLATFORM uECC_arm - #elif defined(__i386__) || defined(_M_IX86) || defined(_X86_) || defined(__I86__) - #define uECC_PLATFORM uECC_x86 - #elif defined(__amd64__) || defined(_M_X64) - #define uECC_PLATFORM uECC_x86_64 - #else - #define uECC_PLATFORM uECC_arch_other - #endif -#endif - -#define uECC_WORD_SIZE 4 - -#if __STDC_VERSION__ >= 199901L - #define RESTRICT restrict -#else - #define RESTRICT -#endif - -#define SUPPORTS_INT128 0 - -#define MAX_TRIES 64 - -/* #if uECC_WORD_SIZE == 4 */ -typedef uint32_t uECC_word_t; -typedef uint64_t uECC_dword_t; -typedef unsigned wordcount_t; -typedef int swordcount_t; -typedef int bitcount_t; -typedef int cmpresult_t; - -#define HIGH_BIT_SET 0x80000000 -#define uECC_WORD_BITS 32 -#define uECC_WORD_BITS_SHIFT 5 -#define uECC_WORD_BITS_MASK 0x01F - -#define uECC_WORDS_1 5 -#define uECC_WORDS_2 6 -#define uECC_WORDS_3 8 -#define uECC_WORDS_4 8 -#define uECC_WORDS_5 7 - -#define uECC_N_WORDS_1 6 -#define uECC_N_WORDS_2 6 -#define uECC_N_WORDS_3 8 -#define uECC_N_WORDS_4 8 -#define uECC_N_WORDS_5 7 - -#define Curve_P_1 {0x7FFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} -#define Curve_P_2 {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} -#define Curve_P_3 {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000000, \ - 0x00000000, 0x00000000, 0x00000001, 0xFFFFFFFF} -#define Curve_P_4 {0xFFFFFC2F, 0xFFFFFFFE, 0xFFFFFFFF, 0xFFFFFFFF, \ - 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} -#define Curve_P_5 {0x00000001, 0x00000000, 0x00000000, 0xFFFFFFFF, \ - 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} - -#define Curve_B_1 {0xC565FA45, 0x81D4D4AD, 0x65ACF89F, 0x54BD7A8B, 0x1C97BEFC} -#define Curve_B_2 {0xC146B9B1, 0xFEB8DEEC, 0x72243049, 0x0FA7E9AB, 0xE59C80E7, 0x64210519} -#define Curve_B_3 {0x27D2604B, 0x3BCE3C3E, 0xCC53B0F6, 0x651D06B0, \ - 0x769886BC, 0xB3EBBD55, 0xAA3A93E7, 0x5AC635D8} -#define Curve_B_4 {0x00000007, 0x00000000, 0x00000000, 0x00000000, \ - 0x00000000, 0x00000000, 0x00000000, 0x00000000} -#define Curve_B_5 {0x2355FFB4, 0x270B3943, 0xD7BFD8BA, 0x5044B0B7, \ - 0xF5413256, 0x0C04B3AB, 0xB4050A85} - -#define Curve_G_1 { \ - {0x13CBFC82, 0x68C38BB9, 0x46646989, 0x8EF57328, 0x4A96B568}, \ - {0x7AC5FB32, 0x04235137, 0x59DCC912, 0x3168947D, 0x23A62855}} - -#define Curve_G_2 { \ - {0x82FF1012, 0xF4FF0AFD, 0x43A18800, 0x7CBF20EB, 0xB03090F6, 0x188DA80E}, \ - {0x1E794811, 0x73F977A1, 0x6B24CDD5, 0x631011ED, 0xFFC8DA78, 0x07192B95}} - -#define Curve_G_3 { \ - {0xD898C296, 0xF4A13945, 0x2DEB33A0, 0x77037D81, \ - 0x63A440F2, 0xF8BCE6E5, 0xE12C4247, 0x6B17D1F2}, \ - {0x37BF51F5, 0xCBB64068, 0x6B315ECE, 0x2BCE3357, \ - 0x7C0F9E16, 0x8EE7EB4A, 0xFE1A7F9B, 0x4FE342E2}} - -#define Curve_G_4 { \ - {0x16F81798, 0x59F2815B, 0x2DCE28D9, 0x029BFCDB, \ - 0xCE870B07, 0x55A06295, 0xF9DCBBAC, 0x79BE667E}, \ - {0xFB10D4B8, 0x9C47D08F, 0xA6855419, 0xFD17B448, \ - 0x0E1108A8, 0x5DA4FBFC, 0x26A3C465, 0x483ADA77}} - -#define Curve_G_5 { \ - {0x115C1D21, 0x343280D6, 0x56C21122, 0x4A03C1D3, \ - 0x321390B9, 0x6BB4BF7F, 0xB70E0CBD}, \ - {0x85007E34, 0x44D58199, 0x5A074764, 0xCD4375A0, \ - 0x4C22DFE6, 0xB5F723FB, 0xBD376388}} - -#define Curve_N_1 {0xCA752257, 0xF927AED3, 0x0001F4C8, 0x00000000, 0x00000000, 0x00000001} -#define Curve_N_2 {0xB4D22831, 0x146BC9B1, 0x99DEF836, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} -#define Curve_N_3 {0xFC632551, 0xF3B9CAC2, 0xA7179E84, 0xBCE6FAAD, \ - 0xFFFFFFFF, 0xFFFFFFFF, 0x00000000, 0xFFFFFFFF} -#define Curve_N_4 {0xD0364141, 0xBFD25E8C, 0xAF48A03B, 0xBAAEDCE6, \ - 0xFFFFFFFE, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} -#define Curve_N_5 {0x5C5C2A3D, 0x13DD2945, 0xE0B8F03E, 0xFFFF16A2, \ - 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} - -/* #endif */ - -#define uECC_WORDS uECC_CONCAT(uECC_WORDS_, uECC_CURVE) -#define uECC_N_WORDS uECC_CONCAT(uECC_N_WORDS_, uECC_CURVE) - -typedef struct EccPoint { - uECC_word_t x[uECC_WORDS]; - uECC_word_t y[uECC_WORDS]; -} EccPoint; - -static const uECC_word_t curve_p[uECC_WORDS] = uECC_CONCAT(Curve_P_, uECC_CURVE); -static const EccPoint curve_G = uECC_CONCAT(Curve_G_, uECC_CURVE); -static const uECC_word_t curve_n[uECC_N_WORDS] = uECC_CONCAT(Curve_N_, uECC_CURVE); - -static void vli_clear(uECC_word_t *vli); -static uECC_word_t vli_isZero(const uECC_word_t *vli); -static uECC_word_t vli_testBit(const uECC_word_t *vli, bitcount_t bit); -static void vli_set(uECC_word_t *dest, const uECC_word_t *src); -static cmpresult_t vli_cmp(const uECC_word_t *left, const uECC_word_t *right); -static void vli_rshift1(uECC_word_t *vli); -static uECC_word_t vli_add(uECC_word_t *result, - const uECC_word_t *left, - const uECC_word_t *right); -static uECC_word_t vli_sub(uECC_word_t *result, - const uECC_word_t *left, - const uECC_word_t *right); -static void vli_mult(uECC_word_t *result, const uECC_word_t *left, const uECC_word_t *right); -static void vli_modAdd(uECC_word_t *result, - const uECC_word_t *left, - const uECC_word_t *right, - const uECC_word_t *mod); -static void vli_modSub(uECC_word_t *result, - const uECC_word_t *left, - const uECC_word_t *right, - const uECC_word_t *mod); -static void vli_mmod_fast(uECC_word_t *RESTRICT result, uECC_word_t *RESTRICT product); -static void vli_modMult_fast(uECC_word_t *result, - const uECC_word_t *left, - const uECC_word_t *right); -static void vli_modInv(uECC_word_t *result, const uECC_word_t *input, const uECC_word_t *mod); -#if uECC_SQUARE_FUNC -static void vli_square(uECC_word_t *result, const uECC_word_t *left); -static void vli_modSquare_fast(uECC_word_t *result, const uECC_word_t *left); -#endif - -static int default_RNG(uint8_t *dest, unsigned size) { - return 0; -} - - -static uECC_RNG_Function g_rng_function = &default_RNG; - -void uECC_set_rng(uECC_RNG_Function rng_function) { - g_rng_function = rng_function; -} - -#ifdef __GNUC__ /* Only support GCC inline asm for now */ - #if (uECC_ASM && (uECC_PLATFORM == uECC_arm || uECC_PLATFORM == uECC_arm_thumb || \ - uECC_PLATFORM == uECC_arm_thumb2)) - #include "asm_arm.inc" - #endif -#endif - -#if !defined(asm_clear) || !asm_clear -static void vli_clear(uECC_word_t *vli) { - wordcount_t i; - for (i = 0; i < uECC_WORDS; ++i) { - vli[i] = 0; - } -} -#endif - -/* Returns 1 if vli == 0, 0 otherwise. */ -#if !defined(asm_isZero) || !asm_isZero -static uECC_word_t vli_isZero(const uECC_word_t *vli) { - wordcount_t i; - for (i = 0; i < uECC_WORDS; ++i) { - if (vli[i]) { - return 0; - } - } - return 1; -} -#endif - -/* Returns nonzero if bit 'bit' of vli is set. */ -#if !defined(asm_testBit) || !asm_testBit -static uECC_word_t vli_testBit(const uECC_word_t *vli, bitcount_t bit) { - return (vli[bit >> uECC_WORD_BITS_SHIFT] & ((uECC_word_t)1 << (bit & uECC_WORD_BITS_MASK))); -} -#endif - -/* Sets dest = src. */ -#if !defined(asm_set) || !asm_set -static void vli_set(uECC_word_t *dest, const uECC_word_t *src) { - wordcount_t i; - for (i = 0; i < uECC_WORDS; ++i) { - dest[i] = src[i]; - } -} -#endif - -/* Returns sign of left - right. */ -#if !defined(asm_cmp) || !asm_cmp -static cmpresult_t vli_cmp(const uECC_word_t *left, const uECC_word_t *right) { - swordcount_t i; - for (i = uECC_WORDS - 1; i >= 0; --i) { - if (left[i] > right[i]) { - return 1; - } else if (left[i] < right[i]) { - return -1; - } - } - return 0; -} -#endif - -/* Computes vli = vli >> 1. */ -#if !defined(asm_rshift1) || !asm_rshift1 -static void vli_rshift1(uECC_word_t *vli) { - uECC_word_t *end = vli; - uECC_word_t carry = 0; - - vli += uECC_WORDS; - while (vli-- > end) { - uECC_word_t temp = *vli; - *vli = (temp >> 1) | carry; - carry = temp << (uECC_WORD_BITS - 1); - } -} -#endif - -/* Computes result = left + right, returning carry. Can modify in place. */ -#if !defined(asm_add) || !asm_add -static uECC_word_t vli_add(uECC_word_t *result, const uECC_word_t *left, const uECC_word_t *right) { - uECC_word_t carry = 0; - wordcount_t i; - for (i = 0; i < uECC_WORDS; ++i) { - uECC_word_t sum = left[i] + right[i] + carry; - if (sum != left[i]) { - carry = (sum < left[i]); - } - result[i] = sum; - } - return carry; -} -#endif - -/* Computes result = left - right, returning borrow. Can modify in place. */ -#if !defined(asm_sub) || !asm_sub -static uECC_word_t vli_sub(uECC_word_t *result, const uECC_word_t *left, const uECC_word_t *right) { - uECC_word_t borrow = 0; - wordcount_t i; - for (i = 0; i < uECC_WORDS; ++i) { - uECC_word_t diff = left[i] - right[i] - borrow; - if (diff != left[i]) { - borrow = (diff > left[i]); - } - result[i] = diff; - } - return borrow; -} -#endif - -#if (!asm_mult || (uECC_SQUARE_FUNC && !asm_square) || uECC_CURVE == uECC_secp256k1) -static void muladd(uECC_word_t a, - uECC_word_t b, - uECC_word_t *r0, - uECC_word_t *r1, - uECC_word_t *r2) { - uECC_dword_t p = (uECC_dword_t)a * b; - uECC_dword_t r01 = ((uECC_dword_t)(*r1) << uECC_WORD_BITS) | *r0; - r01 += p; - *r2 += (r01 < p); - *r1 = r01 >> uECC_WORD_BITS; - *r0 = (uECC_word_t)r01; -} -#define muladd_exists 1 -#endif - -#if !asm_mult -static void vli_mult(uECC_word_t *result, const uECC_word_t *left, const uECC_word_t *right) { - uECC_word_t r0 = 0; - uECC_word_t r1 = 0; - uECC_word_t r2 = 0; - wordcount_t i, k; - - /* Compute each digit of result in sequence, maintaining the carries. */ - for (k = 0; k < uECC_WORDS; ++k) { - for (i = 0; i <= k; ++i) { - muladd(left[i], right[k - i], &r0, &r1, &r2); - } - result[k] = r0; - r0 = r1; - r1 = r2; - r2 = 0; - } - for (k = uECC_WORDS; k < uECC_WORDS * 2 - 1; ++k) { - for (i = (k + 1) - uECC_WORDS; i < uECC_WORDS; ++i) { - muladd(left[i], right[k - i], &r0, &r1, &r2); - } - result[k] = r0; - r0 = r1; - r1 = r2; - r2 = 0; - } - result[uECC_WORDS * 2 - 1] = r0; -} -#endif - -#if uECC_SQUARE_FUNC - -#if !asm_square -static void mul2add(uECC_word_t a, - uECC_word_t b, - uECC_word_t *r0, - uECC_word_t *r1, - uECC_word_t *r2) { - uECC_dword_t p = (uECC_dword_t)a * b; - uECC_dword_t r01 = ((uECC_dword_t)(*r1) << uECC_WORD_BITS) | *r0; - *r2 += (p >> (uECC_WORD_BITS * 2 - 1)); - p *= 2; - r01 += p; - *r2 += (r01 < p); - *r1 = r01 >> uECC_WORD_BITS; - *r0 = (uECC_word_t)r01; -} - -static void vli_square(uECC_word_t *result, const uECC_word_t *left) { - uECC_word_t r0 = 0; - uECC_word_t r1 = 0; - uECC_word_t r2 = 0; - - wordcount_t i, k; - - for (k = 0; k < uECC_WORDS * 2 - 1; ++k) { - uECC_word_t min = (k < uECC_WORDS ? 0 : (k + 1) - uECC_WORDS); - for (i = min; i <= k && i <= k - i; ++i) { - if (i < k-i) { - mul2add(left[i], left[k - i], &r0, &r1, &r2); - } else { - muladd(left[i], left[k - i], &r0, &r1, &r2); - } - } - result[k] = r0; - r0 = r1; - r1 = r2; - r2 = 0; - } - - result[uECC_WORDS * 2 - 1] = r0; -} -#endif - -#else /* uECC_SQUARE_FUNC */ - -#define vli_square(result, left, size) vli_mult((result), (left), (left), (size)) - -#endif /* uECC_SQUARE_FUNC */ - - -/* Computes result = (left + right) % mod. - Assumes that left < mod and right < mod, and that result does not overlap mod. */ -#if !defined(asm_modAdd) || !asm_modAdd -static void vli_modAdd(uECC_word_t *result, - const uECC_word_t *left, - const uECC_word_t *right, - const uECC_word_t *mod) { - uECC_word_t carry = vli_add(result, left, right); - if (carry || vli_cmp(result, mod) >= 0) { - /* result > mod (result = mod + remainder), so subtract mod to get remainder. */ - vli_sub(result, result, mod); - } -} -#endif - -/* Computes result = (left - right) % mod. - Assumes that left < mod and right < mod, and that result does not overlap mod. */ -#if !defined(asm_modSub) || !asm_modSub -static void vli_modSub(uECC_word_t *result, - const uECC_word_t *left, - const uECC_word_t *right, - const uECC_word_t *mod) { - uECC_word_t l_borrow = vli_sub(result, left, right); - if (l_borrow) { - /* In this case, result == -diff == (max int) - diff. Since -x % d == d - x, - we can get the correct result from result + mod (with overflow). */ - vli_add(result, result, mod); - } -} -#endif - -#if !defined(asm_modSub_fast) || !asm_modSub_fast - #define vli_modSub_fast(result, left, right) vli_modSub((result), (left), (right), curve_p) -#endif - -#if !defined(asm_mmod_fast) || !asm_mmod_fast - -#if uECC_CURVE == uECC_secp256r1 - -/* Computes result = product % curve_p - from http://www.nsa.gov/ia/_files/nist-routines.pdf */ -#if uECC_WORD_SIZE == 4 -static void vli_mmod_fast(uint32_t *RESTRICT result, uint32_t *RESTRICT product) { - uint32_t tmp[uECC_WORDS]; - int carry; - - /* t */ - vli_set(result, product); - - /* s1 */ - tmp[0] = tmp[1] = tmp[2] = 0; - tmp[3] = product[11]; - tmp[4] = product[12]; - tmp[5] = product[13]; - tmp[6] = product[14]; - tmp[7] = product[15]; - carry = vli_add(tmp, tmp, tmp); - carry += vli_add(result, result, tmp); - - /* s2 */ - tmp[3] = product[12]; - tmp[4] = product[13]; - tmp[5] = product[14]; - tmp[6] = product[15]; - tmp[7] = 0; - carry += vli_add(tmp, tmp, tmp); - carry += vli_add(result, result, tmp); - - /* s3 */ - tmp[0] = product[8]; - tmp[1] = product[9]; - tmp[2] = product[10]; - tmp[3] = tmp[4] = tmp[5] = 0; - tmp[6] = product[14]; - tmp[7] = product[15]; - carry += vli_add(result, result, tmp); - - /* s4 */ - tmp[0] = product[9]; - tmp[1] = product[10]; - tmp[2] = product[11]; - tmp[3] = product[13]; - tmp[4] = product[14]; - tmp[5] = product[15]; - tmp[6] = product[13]; - tmp[7] = product[8]; - carry += vli_add(result, result, tmp); - - /* d1 */ - tmp[0] = product[11]; - tmp[1] = product[12]; - tmp[2] = product[13]; - tmp[3] = tmp[4] = tmp[5] = 0; - tmp[6] = product[8]; - tmp[7] = product[10]; - carry -= vli_sub(result, result, tmp); - - /* d2 */ - tmp[0] = product[12]; - tmp[1] = product[13]; - tmp[2] = product[14]; - tmp[3] = product[15]; - tmp[4] = tmp[5] = 0; - tmp[6] = product[9]; - tmp[7] = product[11]; - carry -= vli_sub(result, result, tmp); - - /* d3 */ - tmp[0] = product[13]; - tmp[1] = product[14]; - tmp[2] = product[15]; - tmp[3] = product[8]; - tmp[4] = product[9]; - tmp[5] = product[10]; - tmp[6] = 0; - tmp[7] = product[12]; - carry -= vli_sub(result, result, tmp); - - /* d4 */ - tmp[0] = product[14]; - tmp[1] = product[15]; - tmp[2] = 0; - tmp[3] = product[9]; - tmp[4] = product[10]; - tmp[5] = product[11]; - tmp[6] = 0; - tmp[7] = product[13]; - carry -= vli_sub(result, result, tmp); - - if (carry < 0) { - do { - carry += vli_add(result, result, curve_p); - } while (carry < 0); - } else { - while (carry || vli_cmp(curve_p, result) != 1) { - carry -= vli_sub(result, result, curve_p); - } - } -} -#endif /* uECC_WORD_SIZE */ -#endif /* uECC_CURVE */ -#endif /* !asm_mmod_fast */ - -/* Computes result = (left * right) % curve_p. */ -static void vli_modMult_fast(uECC_word_t *result, - const uECC_word_t *left, - const uECC_word_t *right) { - uECC_word_t product[2 * uECC_WORDS]; - vli_mult(product, left, right); - vli_mmod_fast(result, product); -} - -#if uECC_SQUARE_FUNC - -/* Computes result = left^2 % curve_p. */ -static void vli_modSquare_fast(uECC_word_t *result, const uECC_word_t *left) { - uECC_word_t product[2 * uECC_WORDS]; - vli_square(product, left); - vli_mmod_fast(result, product); -} - -#else /* uECC_SQUARE_FUNC */ - -#define vli_modSquare_fast(result, left) vli_modMult_fast((result), (left), (left)) - -#endif /* uECC_SQUARE_FUNC */ - - -#define EVEN(vli) (!(vli[0] & 1)) -/* Computes result = (1 / input) % mod. All VLIs are the same size. - See "From Euclid's GCD to Montgomery Multiplication to the Great Divide" - https://labs.oracle.com/techrep/2001/smli_tr-2001-95.pdf */ -#if !defined(asm_modInv) || !asm_modInv -static void vli_modInv(uECC_word_t *result, const uECC_word_t *input, const uECC_word_t *mod) { - uECC_word_t a[uECC_WORDS], b[uECC_WORDS], u[uECC_WORDS], v[uECC_WORDS]; - uECC_word_t carry; - cmpresult_t cmpResult; - - if (vli_isZero(input)) { - vli_clear(result); - return; - } - - vli_set(a, input); - vli_set(b, mod); - vli_clear(u); - u[0] = 1; - vli_clear(v); - while ((cmpResult = vli_cmp(a, b)) != 0) { - carry = 0; - if (EVEN(a)) { - vli_rshift1(a); - if (!EVEN(u)) { - carry = vli_add(u, u, mod); - } - vli_rshift1(u); - if (carry) { - u[uECC_WORDS - 1] |= HIGH_BIT_SET; - } - } else if (EVEN(b)) { - vli_rshift1(b); - if (!EVEN(v)) { - carry = vli_add(v, v, mod); - } - vli_rshift1(v); - if (carry) { - v[uECC_WORDS - 1] |= HIGH_BIT_SET; - } - } else if (cmpResult > 0) { - vli_sub(a, a, b); - vli_rshift1(a); - if (vli_cmp(u, v) < 0) { - vli_add(u, u, mod); - } - vli_sub(u, u, v); - if (!EVEN(u)) { - carry = vli_add(u, u, mod); - } - vli_rshift1(u); - if (carry) { - u[uECC_WORDS - 1] |= HIGH_BIT_SET; - } - } else { - vli_sub(b, b, a); - vli_rshift1(b); - if (vli_cmp(v, u) < 0) { - vli_add(v, v, mod); - } - vli_sub(v, v, u); - if (!EVEN(v)) { - carry = vli_add(v, v, mod); - } - vli_rshift1(v); - if (carry) { - v[uECC_WORDS - 1] |= HIGH_BIT_SET; - } - } - } - vli_set(result, u); -} -#endif /* !asm_modInv */ - -/* ------ Point operations ------ */ - -/* Returns 1 if 'point' is the point at infinity, 0 otherwise. */ -static cmpresult_t EccPoint_isZero(const EccPoint *point) { - return (vli_isZero(point->x) && vli_isZero(point->y)); -} - -/* Point multiplication algorithm using Montgomery's ladder with co-Z coordinates. -From http://eprint.iacr.org/2011/338.pdf -*/ - -/* Double in place */ -static void EccPoint_double_jacobian(uECC_word_t * RESTRICT X1, - uECC_word_t * RESTRICT Y1, - uECC_word_t * RESTRICT Z1) { - /* t1 = X, t2 = Y, t3 = Z */ - uECC_word_t t4[uECC_WORDS]; - uECC_word_t t5[uECC_WORDS]; - - if (vli_isZero(Z1)) { - return; - } - - vli_modSquare_fast(t4, Y1); /* t4 = y1^2 */ - vli_modMult_fast(t5, X1, t4); /* t5 = x1*y1^2 = A */ - vli_modSquare_fast(t4, t4); /* t4 = y1^4 */ - vli_modMult_fast(Y1, Y1, Z1); /* t2 = y1*z1 = z3 */ - vli_modSquare_fast(Z1, Z1); /* t3 = z1^2 */ - - vli_modAdd(X1, X1, Z1, curve_p); /* t1 = x1 + z1^2 */ - vli_modAdd(Z1, Z1, Z1, curve_p); /* t3 = 2*z1^2 */ - vli_modSub_fast(Z1, X1, Z1); /* t3 = x1 - z1^2 */ - vli_modMult_fast(X1, X1, Z1); /* t1 = x1^2 - z1^4 */ - - vli_modAdd(Z1, X1, X1, curve_p); /* t3 = 2*(x1^2 - z1^4) */ - vli_modAdd(X1, X1, Z1, curve_p); /* t1 = 3*(x1^2 - z1^4) */ - if (vli_testBit(X1, 0)) { - uECC_word_t l_carry = vli_add(X1, X1, curve_p); - vli_rshift1(X1); - X1[uECC_WORDS - 1] |= l_carry << (uECC_WORD_BITS - 1); - } else { - vli_rshift1(X1); - } - /* t1 = 3/2*(x1^2 - z1^4) = B */ - - vli_modSquare_fast(Z1, X1); /* t3 = B^2 */ - vli_modSub_fast(Z1, Z1, t5); /* t3 = B^2 - A */ - vli_modSub_fast(Z1, Z1, t5); /* t3 = B^2 - 2A = x3 */ - vli_modSub_fast(t5, t5, Z1); /* t5 = A - x3 */ - vli_modMult_fast(X1, X1, t5); /* t1 = B * (A - x3) */ - vli_modSub_fast(t4, X1, t4); /* t4 = B * (A - x3) - y1^4 = y3 */ - - vli_set(X1, Z1); - vli_set(Z1, Y1); - vli_set(Y1, t4); -} - -/* Modify (x1, y1) => (x1 * z^2, y1 * z^3) */ -static void apply_z(uECC_word_t * RESTRICT X1, - uECC_word_t * RESTRICT Y1, - const uECC_word_t * RESTRICT Z) { - uECC_word_t t1[uECC_WORDS]; - - vli_modSquare_fast(t1, Z); /* z^2 */ - vli_modMult_fast(X1, X1, t1); /* x1 * z^2 */ - vli_modMult_fast(t1, t1, Z); /* z^3 */ - vli_modMult_fast(Y1, Y1, t1); /* y1 * z^3 */ -} - -/* P = (x1, y1) => 2P, (x2, y2) => P' */ -static void XYcZ_initial_double(uECC_word_t * RESTRICT X1, - uECC_word_t * RESTRICT Y1, - uECC_word_t * RESTRICT X2, - uECC_word_t * RESTRICT Y2, - const uECC_word_t * RESTRICT initial_Z) { - uECC_word_t z[uECC_WORDS]; - if (initial_Z) { - vli_set(z, initial_Z); - } else { - vli_clear(z); - z[0] = 1; - } - - vli_set(X2, X1); - vli_set(Y2, Y1); - - apply_z(X1, Y1, z); - EccPoint_double_jacobian(X1, Y1, z); - apply_z(X2, Y2, z); -} - -/* Input P = (x1, y1, Z), Q = (x2, y2, Z) - Output P' = (x1', y1', Z3), P + Q = (x3, y3, Z3) - or P => P', Q => P + Q -*/ -static void XYcZ_add(uECC_word_t * RESTRICT X1, - uECC_word_t * RESTRICT Y1, - uECC_word_t * RESTRICT X2, - uECC_word_t * RESTRICT Y2) { - /* t1 = X1, t2 = Y1, t3 = X2, t4 = Y2 */ - uECC_word_t t5[uECC_WORDS]; - - vli_modSub_fast(t5, X2, X1); /* t5 = x2 - x1 */ - vli_modSquare_fast(t5, t5); /* t5 = (x2 - x1)^2 = A */ - vli_modMult_fast(X1, X1, t5); /* t1 = x1*A = B */ - vli_modMult_fast(X2, X2, t5); /* t3 = x2*A = C */ - vli_modSub_fast(Y2, Y2, Y1); /* t4 = y2 - y1 */ - vli_modSquare_fast(t5, Y2); /* t5 = (y2 - y1)^2 = D */ - - vli_modSub_fast(t5, t5, X1); /* t5 = D - B */ - vli_modSub_fast(t5, t5, X2); /* t5 = D - B - C = x3 */ - vli_modSub_fast(X2, X2, X1); /* t3 = C - B */ - vli_modMult_fast(Y1, Y1, X2); /* t2 = y1*(C - B) */ - vli_modSub_fast(X2, X1, t5); /* t3 = B - x3 */ - vli_modMult_fast(Y2, Y2, X2); /* t4 = (y2 - y1)*(B - x3) */ - vli_modSub_fast(Y2, Y2, Y1); /* t4 = y3 */ - - vli_set(X2, t5); -} - -/* Input P = (x1, y1, Z), Q = (x2, y2, Z) - Output P + Q = (x3, y3, Z3), P - Q = (x3', y3', Z3) - or P => P - Q, Q => P + Q -*/ -static void XYcZ_addC(uECC_word_t * RESTRICT X1, - uECC_word_t * RESTRICT Y1, - uECC_word_t * RESTRICT X2, - uECC_word_t * RESTRICT Y2) { - /* t1 = X1, t2 = Y1, t3 = X2, t4 = Y2 */ - uECC_word_t t5[uECC_WORDS]; - uECC_word_t t6[uECC_WORDS]; - uECC_word_t t7[uECC_WORDS]; - - vli_modSub_fast(t5, X2, X1); /* t5 = x2 - x1 */ - vli_modSquare_fast(t5, t5); /* t5 = (x2 - x1)^2 = A */ - vli_modMult_fast(X1, X1, t5); /* t1 = x1*A = B */ - vli_modMult_fast(X2, X2, t5); /* t3 = x2*A = C */ - vli_modAdd(t5, Y2, Y1, curve_p); /* t5 = y2 + y1 */ - vli_modSub_fast(Y2, Y2, Y1); /* t4 = y2 - y1 */ - - vli_modSub_fast(t6, X2, X1); /* t6 = C - B */ - vli_modMult_fast(Y1, Y1, t6); /* t2 = y1 * (C - B) = E */ - vli_modAdd(t6, X1, X2, curve_p); /* t6 = B + C */ - vli_modSquare_fast(X2, Y2); /* t3 = (y2 - y1)^2 = D */ - vli_modSub_fast(X2, X2, t6); /* t3 = D - (B + C) = x3 */ - - vli_modSub_fast(t7, X1, X2); /* t7 = B - x3 */ - vli_modMult_fast(Y2, Y2, t7); /* t4 = (y2 - y1)*(B - x3) */ - vli_modSub_fast(Y2, Y2, Y1); /* t4 = (y2 - y1)*(B - x3) - E = y3 */ - - vli_modSquare_fast(t7, t5); /* t7 = (y2 + y1)^2 = F */ - vli_modSub_fast(t7, t7, t6); /* t7 = F - (B + C) = x3' */ - vli_modSub_fast(t6, t7, X1); /* t6 = x3' - B */ - vli_modMult_fast(t6, t6, t5); /* t6 = (y2 + y1)*(x3' - B) */ - vli_modSub_fast(Y1, t6, Y1); /* t2 = (y2 + y1)*(x3' - B) - E = y3' */ - - vli_set(X1, t7); -} - -enum -{ - ECC_POINT_MULT_STATE_INIT, - ECC_POINT_MULT_STATE_BIT_ADDC, - ECC_POINT_MULT_STATE_BIT_ADD, - ECC_POINT_MULT_STATE_EXIT_ADDC, - ECC_POINT_MULT_STATE_EXIT_ADD, - ECC_POINT_MULT_STATE_COMPLETE -}; - -typedef struct -{ - uint8_t state; - uECC_word_t Rx[2][uECC_WORDS]; - uECC_word_t Ry[2][uECC_WORDS]; - bitcount_t i; -} EccPointMultCtx; - -static int EccPoint_mult(EccPointMultCtx *pCtx, - EccPoint * RESTRICT result, - const EccPoint * RESTRICT point, - const uECC_word_t * RESTRICT scalar, - const uECC_word_t * RESTRICT initialZ, - bitcount_t numBits) { - uECC_word_t nb; - uECC_word_t z[uECC_WORDS]; - - switch (pCtx->state) { - case ECC_POINT_MULT_STATE_INIT: - vli_set(pCtx->Rx[1], point->x); - vli_set(pCtx->Ry[1], point->y); - - XYcZ_initial_double(pCtx->Rx[1], pCtx->Ry[1], pCtx->Rx[0], pCtx->Ry[0], initialZ); - - pCtx->i = numBits - 2; - pCtx->state = ECC_POINT_MULT_STATE_BIT_ADDC; - return 0; - - case ECC_POINT_MULT_STATE_BIT_ADDC: - nb = !vli_testBit(scalar, pCtx->i); - XYcZ_addC(pCtx->Rx[1 - nb], pCtx->Ry[1 - nb], pCtx->Rx[nb], pCtx->Ry[nb]); - - pCtx->state = ECC_POINT_MULT_STATE_BIT_ADD; - return 0; - - case ECC_POINT_MULT_STATE_BIT_ADD: - nb = !vli_testBit(scalar, pCtx->i); - XYcZ_add(pCtx->Rx[nb], pCtx->Ry[nb], pCtx->Rx[1 - nb], pCtx->Ry[1 - nb]); - - pCtx->i--; - pCtx->state = (pCtx->i > 0) ? ECC_POINT_MULT_STATE_BIT_ADDC : ECC_POINT_MULT_STATE_EXIT_ADDC; - return 0; - - case ECC_POINT_MULT_STATE_EXIT_ADDC: - nb = !vli_testBit(scalar, 0); - XYcZ_addC(pCtx->Rx[1 - nb], pCtx->Ry[1 - nb], pCtx->Rx[nb], pCtx->Ry[nb]); - - pCtx->state = ECC_POINT_MULT_STATE_EXIT_ADD; - return 0; - - case ECC_POINT_MULT_STATE_EXIT_ADD: - nb = !vli_testBit(scalar, 0); - - /* Find final 1/Z value. */ - vli_modSub_fast(z, pCtx->Rx[1], pCtx->Rx[0]); /* X1 - X0 */ - vli_modMult_fast(z, z, pCtx->Ry[1 - nb]); /* Yb * (X1 - X0) */ - vli_modMult_fast(z, z, point->x); /* xP * Yb * (X1 - X0) */ - vli_modInv(z, z, curve_p); /* 1 / (xP * Yb * (X1 - X0)) */ - vli_modMult_fast(z, z, point->y); /* yP / (xP * Yb * (X1 - X0)) */ - vli_modMult_fast(z, z, pCtx->Rx[1 - nb]); /* Xb * yP / (xP * Yb * (X1 - X0)) */ - /* End 1/Z calculation */ - - XYcZ_add(pCtx->Rx[nb], pCtx->Ry[nb], pCtx->Rx[1 - nb], pCtx->Ry[1 - nb]); - apply_z(pCtx->Rx[0], pCtx->Ry[0], z); - - vli_set(result->x, pCtx->Rx[0]); - vli_set(result->y, pCtx->Ry[0]); - - pCtx->state = ECC_POINT_MULT_STATE_COMPLETE; - return 1; - - case ECC_POINT_MULT_STATE_COMPLETE: - default: - return 1; - } -} - -#if uECC_WORD_SIZE == 4 - -static void vli_nativeToBytes(uint8_t *bytes, const uint32_t *native) { - unsigned i; - for (i = 0; i < uECC_WORDS; ++i) { - uint8_t *digit = bytes + 4 * (uECC_WORDS - 1 - i); - digit[0] = (uint8_t)(native[i] >> 24); - digit[1] = (uint8_t)(native[i] >> 16); - digit[2] = (uint8_t)(native[i] >> 8); - digit[3] = (uint8_t)(native[i]); - } -} - -static void vli_bytesToNative(uint32_t *native, const uint8_t *bytes) { - unsigned i; - for (i = 0; i < uECC_WORDS; ++i) { - const uint8_t *digit = bytes + 4 * (uECC_WORDS - 1 - i); - native[i] = ((uint32_t)digit[0] << 24) | ((uint32_t)digit[1] << 16) | - ((uint32_t)digit[2] << 8) | (uint32_t)digit[3]; - } -} - -#endif /* uECC_WORD_SIZE */ - -enum -{ - ECC_MAKE_KEY_STATE_INIT, - ECC_MAKE_KEY_STATE_ECC_POINT_MULT, - ECC_MAKE_KEY_STATE_EXIT, - ECC_MAKE_KEY_STATE_COMPLETE -}; - -typedef struct EccMakeKeyCtx { - uint8_t state; - uECC_word_t private[uECC_WORDS]; - EccPoint public; - uECC_word_t tmp1[uECC_WORDS]; - uECC_word_t tmp2[uECC_WORDS]; - uECC_word_t *p2[2]; - uECC_word_t carry; - - EccPointMultCtx pointMultCtx; -} EccMakeKeyCtx; - -typedef struct EccSharedSecretCtx { - uECC_word_t random[uECC_WORDS]; - uECC_word_t *initial_Z; - EccPoint public; - EccPoint product; - uECC_word_t private[uECC_WORDS]; - uECC_word_t tmp[uECC_WORDS]; - uECC_word_t *p2[2]; - uECC_word_t carry; - - EccPointMultCtx pointMultCtx; -} EccSharedSecretCtx; - -typedef union EccCtx { - EccMakeKeyCtx makeKey; - EccSharedSecretCtx sharedSecret; -} EccCtx; - -static EccCtx uECC_ctx; - -/************************************************************************************************** - Make Key -**************************************************************************************************/ - -void uECC_make_key_start(const uint8_t private_key[uECC_BYTES]) { - memset(&uECC_ctx, 0, sizeof(uECC_ctx)); - uECC_ctx.makeKey.state = ECC_MAKE_KEY_STATE_INIT; - vli_bytesToNative(uECC_ctx.makeKey.private, private_key); -} - -int uECC_make_key_continue(void) { - switch (uECC_ctx.makeKey.state) { - case ECC_MAKE_KEY_STATE_INIT: - /* Make sure the private key is in the range [1, n-1]. */ - if (vli_isZero(uECC_ctx.makeKey.private)) { - return 0; - } - - if (vli_cmp(curve_n, uECC_ctx.makeKey.private) != 1) { - return 0; - } - - // Regularize the bitcount for the private key so that attackers cannot use a side channel - // attack to learn the number of leading zeros. - uECC_ctx.makeKey.p2[0] = uECC_ctx.makeKey.tmp1; - uECC_ctx.makeKey.p2[1] = uECC_ctx.makeKey.tmp2; - uECC_ctx.makeKey.carry = vli_add(uECC_ctx.makeKey.tmp1, uECC_ctx.makeKey.private, curve_n); - vli_add(uECC_ctx.makeKey.tmp2, uECC_ctx.makeKey.tmp1, curve_n); - - uECC_ctx.makeKey.pointMultCtx.state = 0; - uECC_ctx.makeKey.state = ECC_MAKE_KEY_STATE_ECC_POINT_MULT; - return 0; - - case ECC_MAKE_KEY_STATE_ECC_POINT_MULT: - if (EccPoint_mult(&uECC_ctx.makeKey.pointMultCtx, - &uECC_ctx.makeKey.public, - &curve_G, - uECC_ctx.makeKey.p2[!uECC_ctx.makeKey.carry], - 0, - (uECC_BYTES * 8) + 1)) { - uECC_ctx.makeKey.state = ECC_MAKE_KEY_STATE_EXIT; - } - return 0; - - case ECC_MAKE_KEY_STATE_EXIT: - if (EccPoint_isZero(&uECC_ctx.makeKey.public)) { - uECC_ctx.makeKey.state = ECC_MAKE_KEY_STATE_INIT; - return 0; - } - - uECC_ctx.makeKey.state = ECC_MAKE_KEY_STATE_COMPLETE; - return 1; - - case ECC_MAKE_KEY_STATE_COMPLETE: - default: - return 1; - } -} - -void uECC_make_key_complete(uint8_t public_key[uECC_BYTES*2], uint8_t private_key[uECC_BYTES]) { - vli_nativeToBytes(private_key, uECC_ctx.makeKey.private); - vli_nativeToBytes(public_key, uECC_ctx.makeKey.public.x); - vli_nativeToBytes(public_key + uECC_BYTES, uECC_ctx.makeKey.public.y); -} - -/************************************************************************************************** - Shared Secret -**************************************************************************************************/ - -void uECC_shared_secret_start(const uint8_t public_key[uECC_BYTES*2], - const uint8_t private_key[uECC_BYTES]) { - uECC_word_t tries; - - memset(&uECC_ctx, 0, sizeof(uECC_ctx)); - - // Try to get a random initial Z value to improve protection against side-channel - // attacks. If the RNG fails every time (eg it was not defined), we continue so that - // uECC_shared_secret() can still work without an RNG defined. - uECC_ctx.sharedSecret.initial_Z = NULL; - for (tries = 0; tries < MAX_TRIES; ++tries) { - if (g_rng_function((uint8_t *)uECC_ctx.sharedSecret.random, sizeof(uECC_ctx.sharedSecret.random)) && !vli_isZero(uECC_ctx.sharedSecret.random)) { - uECC_ctx.sharedSecret.initial_Z = uECC_ctx.sharedSecret.random; - break; - } - } - - vli_bytesToNative(uECC_ctx.sharedSecret.private, private_key); - vli_bytesToNative(uECC_ctx.sharedSecret.public.x, public_key); - vli_bytesToNative(uECC_ctx.sharedSecret.public.y, public_key + uECC_BYTES); - - // Regularize the bitcount for the private key so that attackers cannot use a side channel - // attack to learn the number of leading zeros. - uECC_ctx.sharedSecret.p2[0] = uECC_ctx.sharedSecret.private; - uECC_ctx.sharedSecret.p2[1] = uECC_ctx.sharedSecret.tmp; - uECC_ctx.sharedSecret.carry = vli_add(uECC_ctx.sharedSecret.private, uECC_ctx.sharedSecret.private, curve_n); - vli_add(uECC_ctx.sharedSecret.tmp, uECC_ctx.sharedSecret.private, curve_n); - - uECC_ctx.sharedSecret.pointMultCtx.state = 0; -} - -int uECC_shared_secret_continue(void) { - return EccPoint_mult(&uECC_ctx.sharedSecret.pointMultCtx, - &uECC_ctx.sharedSecret.product, - &uECC_ctx.sharedSecret.public, - uECC_ctx.sharedSecret.p2[!uECC_ctx.sharedSecret.carry], - uECC_ctx.sharedSecret.initial_Z, - (uECC_BYTES * 8) + 1); -} - -void uECC_shared_secret_complete(uint8_t secret[uECC_BYTES]) { - vli_nativeToBytes(secret, uECC_ctx.sharedSecret.product.x); -}