WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #3068 from SparkiDev/modexp-cr 

Use temp with mont mul in constant time exptmod
pull/3078/head
toddouska 2020-06-24 13:19:06 -07:00 committed by GitHub
parent 483b970772 7c615967a9
commit 07c5f36d6d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
wolfcrypt/src/tfm.c
View File

@ -1636,6 +1636,7 @@ static int _fp_exptmod_ct(fp_int * G, fp_int * X, int digits, fp_int * P,
y = (int)(buf >> (DIGIT_BIT - 1)) & 1; y = (int)(buf >> (DIGIT_BIT - 1)) & 1;
buf <<= (fp_digit)1; buf <<= (fp_digit)1;
#ifdef WC_NO_CACHE_RESISTANT
/* do ops */ /* do ops */
err = fp_mul(&R[0], &R[1], &R[y^1]); err = fp_mul(&R[0], &R[1], &R[y^1]);
if (err != FP_OKAY) { if (err != FP_OKAY) {
@ -1652,7 +1653,6 @@ static int _fp_exptmod_ct(fp_int * G, fp_int * X, int digits, fp_int * P,
return err; return err;
} }
#ifdef WC_NO_CACHE_RESISTANT
err = fp_sqr(&R[y], &R[y]); err = fp_sqr(&R[y], &R[y]);
if (err != FP_OKAY) { if (err != FP_OKAY) {
#ifdef WOLFSSL_SMALL_STACK #ifdef WOLFSSL_SMALL_STACK
@ -1668,6 +1668,28 @@ static int _fp_exptmod_ct(fp_int * G, fp_int * X, int digits, fp_int * P,
return err; return err;
} }
#else #else
/* do ops */
err = fp_mul(&R[0], &R[1], &R[2]);
if (err != FP_OKAY) {
#ifdef WOLFSSL_SMALL_STACK
XFREE(R, NULL, DYNAMIC_TYPE_BIGINT);
#endif
return err;
}
err = fp_montgomery_reduce(&R[2], P, mp);
if (err != FP_OKAY) {
#ifdef WOLFSSL_SMALL_STACK
XFREE(R, NULL, DYNAMIC_TYPE_BIGINT);
#endif
return err;
}
/* instead of using R[y^1] for mul, which leaks key bit to cache monitor,
* use R[2] as temp, make sure address calc is constant, keep
* &R[0] and &R[1] in cache */
fp_copy(&R[2],
(fp_int*) ( ((wolfssl_word)&R[0] & wc_off_on_addr[y]) +
((wolfssl_word)&R[1] & wc_off_on_addr[y^1]) ) );
/* instead of using R[y] for sqr, which leaks key bit to cache monitor, /* instead of using R[y] for sqr, which leaks key bit to cache monitor,
* use R[2] as temp, make sure address calc is constant, keep * use R[2] as temp, make sure address calc is constant, keep
* &R[0] and &R[1] in cache */ * &R[0] and &R[1] in cache */