Path: blob/aarch64-shenandoah-jdk8u272-b10/jdk/src/share/native/sun/security/ec/impl/ecl-priv.h
38918 views
/*1* Copyright (c) 2007, 2017, Oracle and/or its affiliates. All rights reserved.2* Use is subject to license terms.3*4* This library is free software; you can redistribute it and/or5* modify it under the terms of the GNU Lesser General Public6* License as published by the Free Software Foundation; either7* version 2.1 of the License, or (at your option) any later version.8*9* This library is distributed in the hope that it will be useful,10* but WITHOUT ANY WARRANTY; without even the implied warranty of11* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU12* Lesser General Public License for more details.13*14* You should have received a copy of the GNU Lesser General Public License15* along with this library; if not, write to the Free Software Foundation,16* Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.17*18* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA19* or visit www.oracle.com if you need additional information or have any20* questions.21*/2223/* *********************************************************************24*25* The Original Code is the elliptic curve math library.26*27* The Initial Developer of the Original Code is28* Sun Microsystems, Inc.29* Portions created by the Initial Developer are Copyright (C) 200330* the Initial Developer. All Rights Reserved.31*32* Contributor(s):33* Stephen Fung <[email protected]> and34* Douglas Stebila <[email protected]>, Sun Microsystems Laboratories35*36* Last Modified Date from the Original Code: May 201737*********************************************************************** */3839#ifndef _ECL_PRIV_H40#define _ECL_PRIV_H4142#include "ecl.h"43#include "mpi.h"44#include "mplogic.h"4546/* MAX_FIELD_SIZE_DIGITS is the maximum size of field element supported */47/* the following needs to go away... */48#if defined(MP_USE_LONG_LONG_DIGIT) || defined(MP_USE_LONG_DIGIT)49#define ECL_SIXTY_FOUR_BIT50#else51#define ECL_THIRTY_TWO_BIT52#endif5354#define ECL_CURVE_DIGITS(curve_size_in_bits) \55(((curve_size_in_bits)+(sizeof(mp_digit)*8-1))/(sizeof(mp_digit)*8))56#define ECL_BITS (sizeof(mp_digit)*8)57#define ECL_MAX_FIELD_SIZE_DIGITS (80/sizeof(mp_digit))5859/* Gets the i'th bit in the binary representation of a. If i >= length(a),60* then return 0. (The above behaviour differs from mpl_get_bit, which61* causes an error if i >= length(a).) */62#define MP_GET_BIT(a, i) \63((i) >= mpl_significant_bits((a))) ? 0 : mpl_get_bit((a), (i))6465#if !defined(MP_NO_MP_WORD) && !defined(MP_NO_ADD_WORD)66#define MP_ADD_CARRY(a1, a2, s, cin, cout) \67{ mp_word w; \68w = ((mp_word)(cin)) + (a1) + (a2); \69s = ACCUM(w); \70cout = CARRYOUT(w); }7172/* Handle case when carry-in value is zero */73#define MP_ADD_CARRY_ZERO(a1, a2, s, cout) \74MP_ADD_CARRY(a1, a2, s, 0, cout);7576#define MP_SUB_BORROW(a1, a2, s, bin, bout) \77{ mp_word w; \78w = ((mp_word)(a1)) - (a2) - (bin); \79s = ACCUM(w); \80bout = (w >> MP_DIGIT_BIT) & 1; }8182#else83/* NOTE,84* cin and cout could be the same variable.85* bin and bout could be the same variable.86* a1 or a2 and s could be the same variable.87* don't trash those outputs until their respective inputs have88* been read. */89#define MP_ADD_CARRY(a1, a2, s, cin, cout) \90{ mp_digit tmp,sum; \91tmp = (a1); \92sum = tmp + (a2); \93tmp = (sum < tmp); /* detect overflow */ \94s = sum += (cin); \95cout = tmp + (sum < (cin)); }9697/* Handle case when carry-in value is zero */98#define MP_ADD_CARRY_ZERO(a1, a2, s, cout) \99{ mp_digit tmp,sum; \100tmp = (a1); \101sum = tmp + (a2); \102tmp = (sum < tmp); /* detect overflow */ \103s = sum; \104cout = tmp; }105106#define MP_SUB_BORROW(a1, a2, s, bin, bout) \107{ mp_digit tmp; \108tmp = (a1); \109s = tmp - (a2); \110tmp = (s > tmp); /* detect borrow */ \111if ((bin) && !s--) tmp++; \112bout = tmp; }113#endif114115116struct GFMethodStr;117typedef struct GFMethodStr GFMethod;118struct GFMethodStr {119/* Indicates whether the structure was constructed from dynamic memory120* or statically created. */121int constructed;122/* Irreducible that defines the field. For prime fields, this is the123* prime p. For binary polynomial fields, this is the bitstring124* representation of the irreducible polynomial. */125mp_int irr;126/* For prime fields, the value irr_arr[0] is the number of bits in the127* field. For binary polynomial fields, the irreducible polynomial128* f(t) is represented as an array of unsigned int[], where f(t) is129* of the form: f(t) = t^p[0] + t^p[1] + ... + t^p[4] where m = p[0]130* > p[1] > ... > p[4] = 0. */131unsigned int irr_arr[5];132/* Field arithmetic methods. All methods (except field_enc and133* field_dec) are assumed to take field-encoded parameters and return134* field-encoded values. All methods (except field_enc and field_dec)135* are required to be implemented. */136mp_err (*field_add) (const mp_int *a, const mp_int *b, mp_int *r,137const GFMethod *meth);138mp_err (*field_neg) (const mp_int *a, mp_int *r, const GFMethod *meth);139mp_err (*field_sub) (const mp_int *a, const mp_int *b, mp_int *r,140const GFMethod *meth);141mp_err (*field_mod) (const mp_int *a, mp_int *r, const GFMethod *meth);142mp_err (*field_mul) (const mp_int *a, const mp_int *b, mp_int *r,143const GFMethod *meth);144mp_err (*field_sqr) (const mp_int *a, mp_int *r, const GFMethod *meth);145mp_err (*field_div) (const mp_int *a, const mp_int *b, mp_int *r,146const GFMethod *meth);147mp_err (*field_enc) (const mp_int *a, mp_int *r, const GFMethod *meth);148mp_err (*field_dec) (const mp_int *a, mp_int *r, const GFMethod *meth);149/* Extra storage for implementation-specific data. Any memory150* allocated to these extra fields will be cleared by extra_free. */151void *extra1;152void *extra2;153void (*extra_free) (GFMethod *meth);154};155156/* Construct generic GFMethods. */157GFMethod *GFMethod_consGFp(const mp_int *irr);158GFMethod *GFMethod_consGFp_mont(const mp_int *irr);159GFMethod *GFMethod_consGF2m(const mp_int *irr,160const unsigned int irr_arr[5]);161/* Free the memory allocated (if any) to a GFMethod object. */162void GFMethod_free(GFMethod *meth);163164struct ECGroupStr {165/* Indicates whether the structure was constructed from dynamic memory166* or statically created. */167int constructed;168/* Field definition and arithmetic. */169GFMethod *meth;170/* Textual representation of curve name, if any. */171char *text;172#ifdef _KERNEL173int text_len;174#endif175/* Curve parameters, field-encoded. */176mp_int curvea, curveb;177/* x and y coordinates of the base point, field-encoded. */178mp_int genx, geny;179/* Order and cofactor of the base point. */180mp_int order;181int cofactor;182/* Point arithmetic methods. All methods are assumed to take183* field-encoded parameters and return field-encoded values. All184* methods (except base_point_mul and points_mul) are required to be185* implemented. */186mp_err (*point_add) (const mp_int *px, const mp_int *py,187const mp_int *qx, const mp_int *qy, mp_int *rx,188mp_int *ry, const ECGroup *group);189mp_err (*point_sub) (const mp_int *px, const mp_int *py,190const mp_int *qx, const mp_int *qy, mp_int *rx,191mp_int *ry, const ECGroup *group);192mp_err (*point_dbl) (const mp_int *px, const mp_int *py, mp_int *rx,193mp_int *ry, const ECGroup *group);194mp_err (*point_mul) (const mp_int *n, const mp_int *px,195const mp_int *py, mp_int *rx, mp_int *ry,196const ECGroup *group, int timing);197mp_err (*base_point_mul) (const mp_int *n, mp_int *rx, mp_int *ry,198const ECGroup *group);199mp_err (*points_mul) (const mp_int *k1, const mp_int *k2,200const mp_int *px, const mp_int *py, mp_int *rx,201mp_int *ry, const ECGroup *group,202int timing);203mp_err (*validate_point) (const mp_int *px, const mp_int *py, const ECGroup *group);204/* Extra storage for implementation-specific data. Any memory205* allocated to these extra fields will be cleared by extra_free. */206void *extra1;207void *extra2;208void (*extra_free) (ECGroup *group);209};210211/* Wrapper functions for generic prime field arithmetic. */212mp_err ec_GFp_add(const mp_int *a, const mp_int *b, mp_int *r,213const GFMethod *meth);214mp_err ec_GFp_neg(const mp_int *a, mp_int *r, const GFMethod *meth);215mp_err ec_GFp_sub(const mp_int *a, const mp_int *b, mp_int *r,216const GFMethod *meth);217218/* fixed length in-line adds. Count is in words */219mp_err ec_GFp_add_3(const mp_int *a, const mp_int *b, mp_int *r,220const GFMethod *meth);221mp_err ec_GFp_add_4(const mp_int *a, const mp_int *b, mp_int *r,222const GFMethod *meth);223mp_err ec_GFp_add_5(const mp_int *a, const mp_int *b, mp_int *r,224const GFMethod *meth);225mp_err ec_GFp_add_6(const mp_int *a, const mp_int *b, mp_int *r,226const GFMethod *meth);227mp_err ec_GFp_sub_3(const mp_int *a, const mp_int *b, mp_int *r,228const GFMethod *meth);229mp_err ec_GFp_sub_4(const mp_int *a, const mp_int *b, mp_int *r,230const GFMethod *meth);231mp_err ec_GFp_sub_5(const mp_int *a, const mp_int *b, mp_int *r,232const GFMethod *meth);233mp_err ec_GFp_sub_6(const mp_int *a, const mp_int *b, mp_int *r,234const GFMethod *meth);235236mp_err ec_GFp_mod(const mp_int *a, mp_int *r, const GFMethod *meth);237mp_err ec_GFp_mul(const mp_int *a, const mp_int *b, mp_int *r,238const GFMethod *meth);239mp_err ec_GFp_sqr(const mp_int *a, mp_int *r, const GFMethod *meth);240mp_err ec_GFp_div(const mp_int *a, const mp_int *b, mp_int *r,241const GFMethod *meth);242/* Wrapper functions for generic binary polynomial field arithmetic. */243mp_err ec_GF2m_add(const mp_int *a, const mp_int *b, mp_int *r,244const GFMethod *meth);245mp_err ec_GF2m_neg(const mp_int *a, mp_int *r, const GFMethod *meth);246mp_err ec_GF2m_mod(const mp_int *a, mp_int *r, const GFMethod *meth);247mp_err ec_GF2m_mul(const mp_int *a, const mp_int *b, mp_int *r,248const GFMethod *meth);249mp_err ec_GF2m_sqr(const mp_int *a, mp_int *r, const GFMethod *meth);250mp_err ec_GF2m_div(const mp_int *a, const mp_int *b, mp_int *r,251const GFMethod *meth);252253/* Montgomery prime field arithmetic. */254mp_err ec_GFp_mul_mont(const mp_int *a, const mp_int *b, mp_int *r,255const GFMethod *meth);256mp_err ec_GFp_sqr_mont(const mp_int *a, mp_int *r, const GFMethod *meth);257mp_err ec_GFp_div_mont(const mp_int *a, const mp_int *b, mp_int *r,258const GFMethod *meth);259mp_err ec_GFp_enc_mont(const mp_int *a, mp_int *r, const GFMethod *meth);260mp_err ec_GFp_dec_mont(const mp_int *a, mp_int *r, const GFMethod *meth);261void ec_GFp_extra_free_mont(GFMethod *meth);262263/* point multiplication */264mp_err ec_pts_mul_basic(const mp_int *k1, const mp_int *k2,265const mp_int *px, const mp_int *py, mp_int *rx,266mp_int *ry, const ECGroup *group,267int timing);268mp_err ec_pts_mul_simul_w2(const mp_int *k1, const mp_int *k2,269const mp_int *px, const mp_int *py, mp_int *rx,270mp_int *ry, const ECGroup *group,271int timing);272273/* Computes the windowed non-adjacent-form (NAF) of a scalar. Out should274* be an array of signed char's to output to, bitsize should be the number275* of bits of out, in is the original scalar, and w is the window size.276* NAF is discussed in the paper: D. Hankerson, J. Hernandez and A.277* Menezes, "Software implementation of elliptic curve cryptography over278* binary fields", Proc. CHES 2000. */279mp_err ec_compute_wNAF(signed char *out, int bitsize, const mp_int *in,280int w);281282/* Optimized field arithmetic */283mp_err ec_group_set_gfp192(ECGroup *group, ECCurveName);284mp_err ec_group_set_gfp224(ECGroup *group, ECCurveName);285mp_err ec_group_set_gfp256(ECGroup *group, ECCurveName);286mp_err ec_group_set_gfp384(ECGroup *group, ECCurveName);287mp_err ec_group_set_gfp521(ECGroup *group, ECCurveName);288mp_err ec_group_set_gf2m163(ECGroup *group, ECCurveName name);289mp_err ec_group_set_gf2m193(ECGroup *group, ECCurveName name);290mp_err ec_group_set_gf2m233(ECGroup *group, ECCurveName name);291292/* Optimized floating-point arithmetic */293#ifdef ECL_USE_FP294mp_err ec_group_set_secp160r1_fp(ECGroup *group);295mp_err ec_group_set_nistp192_fp(ECGroup *group);296mp_err ec_group_set_nistp224_fp(ECGroup *group);297#endif298299#endif /* _ECL_PRIV_H */300301302