ECDSA verification: Use wNAF-based multiplication for non-nistz256 implementations

Cargo.toml

@@ -71,6 +71,7 @@ include = [
     "crypto/fipsmodule/ec/ecp_nistz.h",
     "crypto/fipsmodule/ec/ecp_nistz384.h",
     "crypto/fipsmodule/ec/ecp_nistz384.inl",
+    "crypto/fipsmodule/ec/internal.h",
     "crypto/fipsmodule/ec/gfp_p256.c",
     "crypto/fipsmodule/ec/gfp_p384.c",
     "crypto/fipsmodule/ec/p256.c",
@@ -80,6 +81,7 @@ include = [
     "crypto/fipsmodule/ec/p256_shared.h",
     "crypto/fipsmodule/ec/p256_table.h",
     "crypto/fipsmodule/ec/util.h",
+    "crypto/fipsmodule/ec/wnaf.c",
     "crypto/fipsmodule/ecdsa/ecdsa_verify_tests.txt",
     "crypto/fipsmodule/modes/asm/aesni-gcm-x86_64.pl",
     "crypto/fipsmodule/modes/asm/ghash-armv4.pl",

build.rs

@@ -42,6 +42,7 @@ const RING_SRCS: &[(&[&str], &str)] = &[
     (&[], "crypto/fipsmodule/ec/gfp_p256.c"),
     (&[], "crypto/fipsmodule/ec/gfp_p384.c"),
     (&[], "crypto/fipsmodule/ec/p256.c"),
+    (&[], "crypto/fipsmodule/ec/wnaf.c"),
     (&[], "crypto/limbs/limbs.c"),
     (&[], "crypto/mem.c"),
     (&[], "crypto/poly1305/poly1305.c"),
@@ -903,6 +904,7 @@ fn prefix_all_symbols(pp: char, prefix_prefix: &str, prefix: &str) -> String {
         "LIMBS_reduce_once",
         "LIMBS_select_512_32",
         "LIMBS_shl_mod",
+        "LIMBS_sub_from_assign",
         "LIMBS_sub_mod",
         "LIMBS_window5_split_window",
         "LIMBS_window5_unsplit_window",
@@ -933,6 +935,7 @@ fn prefix_all_symbols(pp: char, prefix_prefix: &str, prefix: &str) -> String {
         "bssl_constant_time_test_main",
         "chacha20_poly1305_open",
         "chacha20_poly1305_seal",
+        "ec_compute_wNAF",
         "fiat_curve25519_adx_mul",
         "fiat_curve25519_adx_square",
         "gcm_ghash_avx",

crypto/fipsmodule/ec/wnaf.c

@@ -0,0 +1,144 @@
+/* Originally written by Bodo Moeller for the OpenSSL project.
+ * ====================================================================
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    [email protected].
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * ([email protected]).  This product includes software written by Tim
+ * Hudson ([email protected]).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * The elliptic curve binary polynomial software is originally written by
+ * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems
+ * Laboratories. */
+
+#include "../bn/internal.h"
+#include "../../internal.h"
+#include "../../limbs/limbs.h"
+
+static int is_bit_set(const Limb limbs[], size_t num_limbs, size_t bit) {
+    size_t i = bit / LIMB_BITS;
+    if (i >= num_limbs) {
+        return 0;
+    }
+    size_t shift = bit % LIMB_BITS;
+    return (limbs[i] >> shift) & 1;
+}
+
+// This file implements the wNAF-based interleaving multi-exponentiation method
+// at:
+//   http://link.springer.com/chapter/10.1007%2F3-540-45537-X_13
+//   http://www.bmoeller.de/pdf/TI-01-08.multiexp.pdf
+
+void ec_compute_wNAF(int8_t *out, const Limb scalar[], size_t scalar_limbs, size_t bits, int w) {
+  // 'int8_t' can represent integers with absolute values less than 2^7.
+  debug_assert_nonsecret(0 < w && w <= 7);
+  debug_assert_nonsecret(bits != 0);
+  int bit = 1 << w;         // 2^w, at most 128
+  int next_bit = bit << 1;  // 2^(w+1), at most 256
+  int mask = next_bit - 1;  // at most 255
+
+  int window_val = ((int)scalar[0]) & mask;
+  for (size_t j = 0; j < bits + 1; j++) {
+    debug_assert_nonsecret(0 <= window_val && window_val <= next_bit);
+    int digit = 0;
+    if (window_val & 1) {
+      debug_assert_nonsecret(0 < window_val && window_val < next_bit);
+      if (window_val & bit) {
+        digit = window_val - next_bit;
+        // We know -next_bit < digit < 0 and window_val - digit = next_bit.
+
+        // modified wNAF
+        if (j + ((size_t)w) + 1 >= bits) {
+          // special case for generating modified wNAFs:
+          // no new bits will be added into window_val,
+          // so using a positive digit here will decrease
+          // the total length of the representation
+
+          digit = window_val & (mask >> 1);
+          // We know 0 < digit < bit and window_val - digit = bit.
+        }
+      } else {
+        digit = window_val;
+        // We know 0 < digit < bit and window_val - digit = 0.
+      }
+
+      window_val -= digit;
+
+      // Now window_val is 0 or 2^(w+1) in standard wNAF generation.
+      // For modified window NAFs, it may also be 2^w.
+      //
+      // See the comments above for the derivation of each of these bounds.
+      debug_assert_nonsecret(window_val == 0 || window_val == next_bit || window_val == bit);
+      debug_assert_nonsecret(-bit < digit && digit < bit);
+
+      // window_val was odd, so digit is also odd.
+      debug_assert_nonsecret(digit & 1);
+    }
+
+    out[j] = (int8_t)digit;
+
+    // Incorporate the next bit. Previously, |window_val| <= |next_bit|, so if
+    // we shift and add at most one copy of |bit|, this will continue to hold
+    // afterwards.
+    window_val >>= 1;
+    window_val += bit * is_bit_set(scalar, scalar_limbs, j + (size_t)w + 1);
+    debug_assert_nonsecret(window_val <= next_bit);
+  }
+
+  // bits + 1 entries should be sufficient to consume all bits.
+  debug_assert_nonsecret(window_val == 0);
+}

crypto/limbs/limbs.c

@@ -122,6 +122,11 @@ void LIMBS_add_mod(Limb r[], const Limb a[], const Limb b[], const Limb m[],
   }
 }
 
+// r := a - r.
+void LIMBS_sub_from_assign(Limb r[], const Limb a[], size_t num_limbs) {
+    (void)limbs_sub(r, a, r, num_limbs);
+}
+
 void LIMBS_sub_mod(Limb r[], const Limb a[], const Limb b[], const Limb m[],
                    size_t num_limbs) {
   Limb underflow =

src/bits.rs

@@ -49,7 +49,7 @@ impl BitLength {
 
     /// The number of bits this bit length represents, as a `usize`.
     #[inline]
-    pub fn as_usize_bits(&self) -> usize {
+    pub const fn as_usize_bits(&self) -> usize {
         self.0
     }