mirror of
https://github.com/jart/cosmopolitan.git
synced 2025-05-28 00:02:28 +00:00
Make stronger crypto nearly as fast
One of the disadvantages of x25519 and ℘256 is it only provides 126 bits of security, so that seems like a weak link in the chain, if we're using ECDHE-ECDSA-AES256-GCM-SHA384. The U.S. government wants classified data to be encrypted using a curve at least as strong as ℘384, which provides 192 bits of security, but if you read the consensus of stack exchange it would give you the impression that ℘384 is three times slower. This change (as well as the previous one) makes ℘384 three times as fast by tuning its modulus and multiplication subroutines with new tests that should convincingly show: the optimized code behaves the same way as the old code. Some of the diff noise from the previous change is now removed too, so that our vendored fork can be more easily compared with upstream sources. So you can now have stronger cryptography without compromises. ℘384 modulus Justine l: 28𝑐 9𝑛𝑠 ℘384 modulus MbedTLS NIST l: 127𝑐 41𝑛𝑠 ℘384 modulus MbedTLS MPI l: 1,850𝑐 597𝑛𝑠 The benchmarks above show the improvements made by secp384r1() which is an important function since it needs to be called 13,000 times whenever someone establishes a connection to your web server. The same's true of Mul6x6Adx() which is able to multiply 384-bit numbers in 73 cycles, but only if your CPU was purchased after 2014 when Broadwell was introduced
This commit is contained in:
Justine Tunney
parent
398f0c16fb
commit
ea83cc0ad0
27 changed files with 4291 additions and 3361 deletions
142
third_party/mbedtls/ecp_curves.c
vendored
142
third_party/mbedtls/ecp_curves.c
vendored
|
|
@ -46,7 +46,7 @@ asm(".include \"libc/disclaimer.inc\"");
|
|||
* limitations under the License.
|
||||
*/
|
||||
|
||||
/* #if defined(MBEDTLS_ECP_C) */
|
||||
#if defined(MBEDTLS_ECP_C)
|
||||
|
||||
#if !defined(MBEDTLS_ECP_ALT)
|
||||
|
||||
|
|
@ -635,12 +635,7 @@ static int ecp_group_load( mbedtls_ecp_group *grp,
|
|||
#endif /* ECP_LOAD_GROUP */
|
||||
|
||||
#if defined(MBEDTLS_ECP_NIST_OPTIM)
|
||||
#define NIST_MODP( P ) grp->modp = ecp_mod_ ## P;
|
||||
#else
|
||||
#define NIST_MODP( P )
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_NIST_OPTIM)
|
||||
/* Forward declarations */
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
|
||||
static int ecp_mod_p192( mbedtls_mpi * );
|
||||
#endif
|
||||
|
|
@ -650,8 +645,13 @@ static int ecp_mod_p224( mbedtls_mpi * );
|
|||
#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
|
||||
static int ecp_mod_p521( mbedtls_mpi * );
|
||||
#endif
|
||||
|
||||
#define NIST_MODP( P ) grp->modp = ecp_mod_ ## P;
|
||||
#else
|
||||
#define NIST_MODP( P )
|
||||
#endif /* MBEDTLS_ECP_NIST_OPTIM */
|
||||
|
||||
/* Additional forward declarations */
|
||||
#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
|
||||
static int ecp_mod_p255( mbedtls_mpi * );
|
||||
#endif
|
||||
|
|
@ -771,8 +771,6 @@ cleanup:
|
|||
}
|
||||
#endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
|
||||
|
||||
|
||||
#if defined(MBEDTLS_ECP_C)
|
||||
/**
|
||||
* \brief This function sets up an ECP group context
|
||||
* from a standardized set of domain parameters.
|
||||
|
|
@ -879,7 +877,6 @@ int mbedtls_ecp_group_load( mbedtls_ecp_group *grp, mbedtls_ecp_group_id id )
|
|||
return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_ECP_C */
|
||||
|
||||
#if defined(MBEDTLS_ECP_NIST_OPTIM)
|
||||
/*
|
||||
|
|
@ -892,6 +889,7 @@ int mbedtls_ecp_group_load( mbedtls_ecp_group *grp, mbedtls_ecp_group_id id )
|
|||
* MPI remains loose, since these functions can be deactivated at will.
|
||||
*/
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
|
||||
/*
|
||||
* Compared to the way things are presented in FIPS 186-3 D.2,
|
||||
* we proceed in columns, from right (least significant chunk) to left,
|
||||
|
|
@ -942,13 +940,17 @@ static int ecp_mod_p192( mbedtls_mpi *N )
|
|||
int ret = MBEDTLS_ERR_THIS_CORRUPTION;
|
||||
mbedtls_mpi_uint c = 0;
|
||||
mbedtls_mpi_uint *p, *end;
|
||||
|
||||
/* Make sure we have enough blocks so that A(5) is legal */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_grow( N, 6 * WIDTH ) );
|
||||
|
||||
p = N->p;
|
||||
end = p + N->n;
|
||||
|
||||
ADD( 3 ); ADD( 5 ); NEXT; // A0 += A3 + A5
|
||||
ADD( 3 ); ADD( 4 ); ADD( 5 ); NEXT; // A1 += A3 + A4 + A5
|
||||
ADD( 4 ); ADD( 5 ); LAST; // A2 += A4 + A5
|
||||
|
||||
cleanup:
|
||||
return( ret );
|
||||
}
|
||||
|
|
@ -958,7 +960,11 @@ cleanup:
|
|||
#undef ADD
|
||||
#undef NEXT
|
||||
#undef LAST
|
||||
#endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
|
||||
defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
|
||||
/*
|
||||
* The reader is advised to first understand ecp_mod_p192() since the same
|
||||
* general structure is used here, but with additional complications:
|
||||
|
|
@ -1059,6 +1065,7 @@ static inline void sub32( uint32_t *dst, uint32_t src, signed char *carry )
|
|||
static inline int fix_negative( mbedtls_mpi *N, signed char c, mbedtls_mpi *C, size_t bits )
|
||||
{
|
||||
int ret = MBEDTLS_ERR_THIS_CORRUPTION;
|
||||
|
||||
/* C = - c * 2^(bits + 32) */
|
||||
#if !defined(MBEDTLS_HAVE_INT64)
|
||||
((void) bits);
|
||||
|
|
@ -1068,19 +1075,24 @@ static inline int fix_negative( mbedtls_mpi *N, signed char c, mbedtls_mpi *C, s
|
|||
else
|
||||
#endif
|
||||
C->p[ C->n - 1 ] = (mbedtls_mpi_uint) -c;
|
||||
|
||||
/* N = - ( C - N ) */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( N, C, N ) );
|
||||
N->s = -1;
|
||||
|
||||
cleanup:
|
||||
|
||||
return( ret );
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
|
||||
/*
|
||||
* Fast quasi-reduction modulo p224 (FIPS 186-3 D.2.2)
|
||||
*/
|
||||
static int ecp_mod_p224( mbedtls_mpi *N )
|
||||
{
|
||||
INIT( 224 );
|
||||
|
||||
SUB( 7 ); SUB( 11 ); NEXT; // A0 += -A7 - A11
|
||||
SUB( 8 ); SUB( 12 ); NEXT; // A1 += -A8 - A12
|
||||
SUB( 9 ); SUB( 13 ); NEXT; // A2 += -A9 - A13
|
||||
|
|
@ -1088,9 +1100,97 @@ static int ecp_mod_p224( mbedtls_mpi *N )
|
|||
SUB( 11 ); ADD( 8 ); ADD( 12 ); NEXT; // A4 += -A11 + A8 + A12
|
||||
SUB( 12 ); ADD( 9 ); ADD( 13 ); NEXT; // A5 += -A12 + A9 + A13
|
||||
SUB( 13 ); ADD( 10 ); LAST; // A6 += -A13 + A10
|
||||
|
||||
cleanup:
|
||||
return( ret );
|
||||
}
|
||||
#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
|
||||
/*
|
||||
* Fast quasi-reduction modulo p256 (FIPS 186-3 D.2.3)
|
||||
*/
|
||||
int ecp_mod_p256_old( mbedtls_mpi *N )
|
||||
{
|
||||
INIT( 256 );
|
||||
|
||||
ADD( 8 ); ADD( 9 );
|
||||
SUB( 11 ); SUB( 12 ); SUB( 13 ); SUB( 14 ); NEXT; // A0
|
||||
|
||||
ADD( 9 ); ADD( 10 );
|
||||
SUB( 12 ); SUB( 13 ); SUB( 14 ); SUB( 15 ); NEXT; // A1
|
||||
|
||||
ADD( 10 ); ADD( 11 );
|
||||
SUB( 13 ); SUB( 14 ); SUB( 15 ); NEXT; // A2
|
||||
|
||||
ADD( 11 ); ADD( 11 ); ADD( 12 ); ADD( 12 ); ADD( 13 );
|
||||
SUB( 15 ); SUB( 8 ); SUB( 9 ); NEXT; // A3
|
||||
|
||||
ADD( 12 ); ADD( 12 ); ADD( 13 ); ADD( 13 ); ADD( 14 );
|
||||
SUB( 9 ); SUB( 10 ); NEXT; // A4
|
||||
|
||||
ADD( 13 ); ADD( 13 ); ADD( 14 ); ADD( 14 ); ADD( 15 );
|
||||
SUB( 10 ); SUB( 11 ); NEXT; // A5
|
||||
|
||||
ADD( 14 ); ADD( 14 ); ADD( 15 ); ADD( 15 ); ADD( 14 ); ADD( 13 );
|
||||
SUB( 8 ); SUB( 9 ); NEXT; // A6
|
||||
|
||||
ADD( 15 ); ADD( 15 ); ADD( 15 ); ADD( 8 );
|
||||
SUB( 10 ); SUB( 11 ); SUB( 12 ); SUB( 13 ); LAST; // A7
|
||||
|
||||
cleanup:
|
||||
return( ret );
|
||||
}
|
||||
#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
|
||||
/*
|
||||
* Fast quasi-reduction modulo p384 (FIPS 186-3 D.2.4)
|
||||
*/
|
||||
int ecp_mod_p384_old( mbedtls_mpi *N )
|
||||
{
|
||||
INIT( 384 );
|
||||
|
||||
ADD( 12 ); ADD( 21 ); ADD( 20 );
|
||||
SUB( 23 ); NEXT; // A0
|
||||
|
||||
ADD( 13 ); ADD( 22 ); ADD( 23 );
|
||||
SUB( 12 ); SUB( 20 ); NEXT; // A2
|
||||
|
||||
ADD( 14 ); ADD( 23 );
|
||||
SUB( 13 ); SUB( 21 ); NEXT; // A2
|
||||
|
||||
ADD( 15 ); ADD( 12 ); ADD( 20 ); ADD( 21 );
|
||||
SUB( 14 ); SUB( 22 ); SUB( 23 ); NEXT; // A3
|
||||
|
||||
ADD( 21 ); ADD( 21 ); ADD( 16 ); ADD( 13 ); ADD( 12 ); ADD( 20 ); ADD( 22 );
|
||||
SUB( 15 ); SUB( 23 ); SUB( 23 ); NEXT; // A4
|
||||
|
||||
ADD( 22 ); ADD( 22 ); ADD( 17 ); ADD( 14 ); ADD( 13 ); ADD( 21 ); ADD( 23 );
|
||||
SUB( 16 ); NEXT; // A5
|
||||
|
||||
ADD( 23 ); ADD( 23 ); ADD( 18 ); ADD( 15 ); ADD( 14 ); ADD( 22 );
|
||||
SUB( 17 ); NEXT; // A6
|
||||
|
||||
ADD( 19 ); ADD( 16 ); ADD( 15 ); ADD( 23 );
|
||||
SUB( 18 ); NEXT; // A7
|
||||
|
||||
ADD( 20 ); ADD( 17 ); ADD( 16 );
|
||||
SUB( 19 ); NEXT; // A8
|
||||
|
||||
ADD( 21 ); ADD( 18 ); ADD( 17 );
|
||||
SUB( 20 ); NEXT; // A9
|
||||
|
||||
ADD( 22 ); ADD( 19 ); ADD( 18 );
|
||||
SUB( 21 ); NEXT; // A10
|
||||
|
||||
ADD( 23 ); ADD( 20 ); ADD( 19 );
|
||||
SUB( 22 ); LAST; // A11
|
||||
|
||||
cleanup:
|
||||
return( ret );
|
||||
}
|
||||
#endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
|
||||
|
||||
#undef A
|
||||
#undef LOAD32
|
||||
|
|
@ -1100,6 +1200,10 @@ cleanup:
|
|||
#undef NEXT
|
||||
#undef LAST
|
||||
|
||||
#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED ||
|
||||
MBEDTLS_ECP_DP_SECP256R1_ENABLED ||
|
||||
MBEDTLS_ECP_DP_SECP384R1_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
|
||||
/*
|
||||
* Here we have an actual Mersenne prime, so things are more straightforward.
|
||||
|
|
@ -1156,6 +1260,8 @@ cleanup:
|
|||
|
||||
#endif /* MBEDTLS_ECP_NIST_OPTIM */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
|
||||
|
||||
/* Size of p255 in terms of mbedtls_mpi_uint */
|
||||
#define P255_WIDTH ( 255 / 8 / sizeof( mbedtls_mpi_uint ) + 1 )
|
||||
|
||||
|
|
@ -1169,28 +1275,34 @@ static int ecp_mod_p255( mbedtls_mpi *N )
|
|||
size_t i;
|
||||
mbedtls_mpi M;
|
||||
mbedtls_mpi_uint Mp[P255_WIDTH + 2];
|
||||
|
||||
if( N->n < P255_WIDTH )
|
||||
return( 0 );
|
||||
|
||||
/* M = A1 */
|
||||
M.s = 1;
|
||||
M.n = N->n - ( P255_WIDTH - 1 );
|
||||
if( M.n > P255_WIDTH + 1 )
|
||||
return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
|
||||
M.p = Mp;
|
||||
mbedtls_platform_zeroize( Mp, sizeof Mp );
|
||||
memset( Mp, 0, sizeof Mp );
|
||||
memcpy( Mp, N->p + P255_WIDTH - 1, M.n * sizeof( mbedtls_mpi_uint ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, 255 % ( 8 * sizeof( mbedtls_mpi_uint ) ) ) );
|
||||
M.n++; /* Make room for multiplication by 19 */
|
||||
|
||||
/* N = A0 */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( N, 255, 0 ) );
|
||||
for( i = P255_WIDTH; i < N->n; i++ )
|
||||
N->p[i] = 0;
|
||||
|
||||
/* N = A0 + 19 * A1 */
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &M, &M, 19 ) );
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
|
||||
|
||||
cleanup:
|
||||
return( ret );
|
||||
}
|
||||
#endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
|
||||
|
||||
|
|
@ -1231,7 +1343,7 @@ static int ecp_mod_p448( mbedtls_mpi *N )
|
|||
/* Shouldn't be called with N larger than 2^896! */
|
||||
return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
|
||||
M.p = Mp;
|
||||
mbedtls_platform_zeroize( Mp, sizeof( Mp ) );
|
||||
memset( Mp, 0, sizeof( Mp ) );
|
||||
memcpy( Mp, N->p + P448_WIDTH, M.n * sizeof( mbedtls_mpi_uint ) );
|
||||
|
||||
/* N = A0 */
|
||||
|
|
@ -1299,7 +1411,7 @@ static inline int ecp_mod_koblitz( mbedtls_mpi *N, mbedtls_mpi_uint *Rp, size_t
|
|||
M.n = N->n - ( p_limbs - adjust );
|
||||
if( M.n > p_limbs + adjust )
|
||||
M.n = p_limbs + adjust;
|
||||
mbedtls_platform_zeroize( Mp, sizeof Mp );
|
||||
memset( Mp, 0, sizeof Mp );
|
||||
memcpy( Mp, N->p + p_limbs - adjust, M.n * sizeof( mbedtls_mpi_uint ) );
|
||||
if( shift != 0 )
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, shift ) );
|
||||
|
|
@ -1321,7 +1433,7 @@ static inline int ecp_mod_koblitz( mbedtls_mpi *N, mbedtls_mpi_uint *Rp, size_t
|
|||
M.n = N->n - ( p_limbs - adjust );
|
||||
if( M.n > p_limbs + adjust )
|
||||
M.n = p_limbs + adjust;
|
||||
mbedtls_platform_zeroize( Mp, sizeof Mp );
|
||||
memset( Mp, 0, sizeof Mp );
|
||||
memcpy( Mp, N->p + p_limbs - adjust, M.n * sizeof( mbedtls_mpi_uint ) );
|
||||
if( shift != 0 )
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, shift ) );
|
||||
|
|
@ -1392,4 +1504,4 @@ static int ecp_mod_p256k1( mbedtls_mpi *N )
|
|||
|
||||
#endif /* !MBEDTLS_ECP_ALT */
|
||||
|
||||
/* #endif /\* MBEDTLS_ECP_C *\/ */
|
||||
#endif /* MBEDTLS_ECP_C */
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue