| /* Copyright lowRISC Contributors. |
| * Copyright 2016 The Chromium OS Authors. All rights reserved. |
| * Use of this source code is governed by a BSD-style license that can be |
| * found in the LICENSE.dcrypto file. |
| * |
| * Derived from code in |
| * https://chromium.googlesource.com/chromiumos/platform/ec/+/refs/heads/cr50_stab/chip/g/dcrypto/dcrypto_p256.c |
| */ |
| |
| .globl p256_init |
| .globl p256_isoncurve |
| .globl p256_scalarmult |
| .globl p256_scalar_base_mult |
| .globl p256_sign |
| .globl p256_verify |
| .globl proj_add |
| |
| .text |
| |
| /** |
| * Initialize field modulus and corresponding Barrett constant for P-256 |
| * |
| * This routine runs in constant time. |
| * |
| * Flags: This routine does not modify any flag group |
| * |
| * @param[out] w29: p, modulus of P-256 underlying finite field |
| * @param[out] w28: u, lower 256 bit of Barrett constant for curve P-256 |
| * @param[out] MOD: p, modulus of P-256 underlying finite field |
| * |
| * clobbered registers: x2, w28, w29 |
| * clobbered flag groups: none |
| */ |
| setup_barrett_p: |
| /* load field modulus p = |
| w29 = p = 2^256 - 2^224 + 2^192 + 2^96 - 1 |
| 0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF */ |
| sw x0, 524(x0) |
| sw x0, 528(x0) |
| sw x0, 532(x0) |
| addi x2, x0, 1 |
| sw x2, 536(x0) |
| addi x2, x0, -1 |
| sw x2, 512(x0) |
| sw x2, 516(x0) |
| sw x2, 520(x0) |
| sw x2, 540(x0) |
| addi x2, x0, 29 |
| bn.lid x2, 512(x0) |
| |
| /* store modulus to MOD WSR */ |
| bn.wsrw 0, w29 |
| |
| /* load Barrett constant u (lower 256 bit only) |
| w28 = u = floor(2^512/p)[255:0] = |
| 0X00000000FFFFFFFFFFFFFFFEFFFFFFFEFFFFFFFEFFFFFFFF0000000000000003*/ |
| sw x0, 548(x0) |
| sw x0, 572(x0) |
| addi x2, x0, -1 |
| sw x2, 552(x0) |
| sw x2, 568(x0) |
| addi x2, x0, 3 |
| sw x2, 544(x0) |
| addi x2, x0, -2 |
| sw x2, 556(x0) |
| sw x2, 560(x0) |
| sw x2, 564(x0) |
| addi x2, x0, 28 |
| bn.lid x2, 544(x0) |
| |
| ret |
| |
| |
| /** |
| * Initialize curve P-256 (secp256r1) |
| * |
| * Setup the context for the P-256 curve: |
| * - load domain parameter b |
| * - load P-256 underlying field modulus p and corresponding Barrett constant |
| * - prepare all-zero-reg and always-one-reg |
| * |
| * Note that the domain parameter 'a' of P-256 can be written as a=-3. |
| * Therefore, parameter 'a' is not provided in a register but has to be |
| * incorporated in the algorithms of the individual subroutines. |
| * This routine runs in constant time. |
| * |
| * Flags: This routine does not modify any flag group |
| * |
| * @param[out] w27: b, domain parameter b of P-256 |
| * @param[out] w28: u, lower 256 bit of Barrett constant for curve P-256 |
| * @param[out] w29: p, modulus of P-256 underlying finite field |
| * @param[out] w30: constant 1 |
| * @param[out] w31: all-zero |
| * |
| * clobbered registers: x2, x3, w27, w28, w29, w30, w31 |
| * clobbered flag groups: none |
| */ |
| p256_init: |
| addi x3, x0, 31 |
| bn.lid x3, 0(x0) |
| |
| /* init all-zero register */ |
| bn.xor w31, w31, w31 |
| |
| /* init reg with constant 1 */ |
| bn.addi w30, w31, 1 |
| |
| /* setup modulus and corresponding Barrett constant */ |
| jal x1, setup_barrett_p |
| |
| /* load domain parameter b via dmem |
| w27 = b |
| b = 0X5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B */ |
| lui x2, 163110 |
| addi x2, x2, 75 |
| sw x2, 576(x0) |
| lui x2, 244964 |
| addi x2, x2, -962 |
| sw x2, 580(x0) |
| lui x2, 836923 |
| addi x2, x2, 246 |
| sw x2, 584(x0) |
| lui x2, 414160 |
| addi x2, x2, 1712 |
| sw x2, 588(x0) |
| lui x2, 485768 |
| addi x2, x2, 1724 |
| sw x2, 592(x0) |
| lui x2, 736956 |
| addi x2, x2, -683 |
| sw x2, 596(x0) |
| lui x2, 697257 |
| addi x2, x2, 999 |
| sw x2, 600(x0) |
| lui x2, 371811 |
| addi x2, x2, 1496 |
| sw x2, 604(x0) |
| addi x2, x0, 27 |
| bn.lid x2, 576(x0) |
| |
| ret |
| |
| |
| /** |
| * 256-bit modular multiplication based on Barrett reduction algorithm. |
| * |
| * Returns c = a * b mod p |
| * |
| * Expects two 256 bit operands, 256 bit modulus and pre-computed parameter u |
| * for Barrett reduction (usually greek mu in literature). u is expected |
| * without the leading 1 at bit 256. u has to be pre-computed as |
| * u = floor(2^512/p). |
| * This guarantees that u > 2^256, however, in order for u to be at |
| * most 2^257-1, it has to be ensured that p >= 2^255 + 1. |
| * |
| * This implementation mostly follows the description in the |
| * "Handbook of Applied Cryptography" in Algorithm 14.42. |
| * Differences: |
| * - This implementation incorporates a multiplication before the reduction. |
| * Therefore it expects two operands (a, b) instead of a wider integer x. |
| * - The computation of q2 ignores the MSbs of q1 and u to allow using |
| * a 256x256 bit multiplication. This is compensated later by |
| * individual (conditional) additions. |
| * - The truncations in step 2 of HAC 14.42 in the form of (... mod b^(k+1) ) |
| * are not implemented here and the full register width is used. This |
| * allows to omit computation of r1 (since r1=x) and step 3 of HAC 14.42 |
| * - There is only a single conditional subtraction of the modulus at the end |
| * |
| * Note that this implementation is targeted and tested to be used with modulus |
| * and Barrett constant of the P-256 underlying finite field only. For a |
| * generic modulus a 2nd conditional subtraction of the modulus has to be |
| * added or the modulus has to be in a range such that it can be mathematically |
| * proven that a single subtraction is sufficient. |
| * |
| * Flags: Flags when leaving this subroutine depend on a potentially discarded |
| * value and therefore are not usable after return. |
| * |
| * @param[in] w24: a, first 256 bit operand (a < p) |
| * @param[in] w25: b, second 256 bit operand with (b < p) |
| * @param[in] w29: p, modulus of P-256 underlying finite field |
| * @param[in] w28: u, lower 256 bit of Barrett constant for curve P-256 |
| * @param[in] w31: all-zero |
| * @param[in] MOD: p, modulus of P-256 underlying finite field |
| * @param[out] w19: c, result |
| * |
| * clobbered registers: w19, w20, w21, w22, w23, w24, w25 |
| * clobbered flag groups: FG0 |
| */ |
| mod_mul_256x256: |
| /* Compute the integer product of the operands x = a * b |
| x = [w20, w19] = a * b = w24 * w25 |
| => max. length x: 512 bit */ |
| bn.mulqacc.z w24.0, w25.0, 0 |
| bn.mulqacc w24.1, w25.0, 64 |
| bn.mulqacc.so w19.L, w24.0, w25.1, 64 |
| bn.mulqacc w24.2, w25.0, 0 |
| bn.mulqacc w24.1, w25.1, 0 |
| bn.mulqacc w24.0, w25.2, 0 |
| bn.mulqacc w24.3, w25.0, 64 |
| bn.mulqacc w24.2, w25.1, 64 |
| bn.mulqacc w24.1, w25.2, 64 |
| bn.mulqacc.so w19.U, w24.0, w25.3, 64 |
| bn.mulqacc w24.3, w25.1, 0 |
| bn.mulqacc w24.2, w25.2, 0 |
| bn.mulqacc w24.1, w25.3, 0 |
| bn.mulqacc w24.3, w25.2, 64 |
| bn.mulqacc.so w20.L, w24.2, w25.3, 64 |
| bn.mulqacc.so w20.U, w24.3, w25.3, 0 |
| bn.add w20, w20, w31 |
| |
| /* Store correction factor to compensate for later neglected MSb of x. |
| x is 512 bit wide and therefore the 255 bit right shifted version q1 |
| (below) contains 257 bit. Bit 256 of q1 is neglected to allow using a |
| 256x256 multiplier. For the MSb of x being set we temporary store u |
| (or zero) here to be used in a later constant time correction of a |
| multiplication with u. Note that this requires the MSb flag being carried |
| over from the multiplication routine. */ |
| bn.sel w22, w28, w31, M |
| |
| /* Compute q1' = q1[255:0] = x >> 255 |
| w21 = q1' = [w20, w19] >> 255 */ |
| bn.rshi w21, w20, w19 >> 255 |
| |
| /* Compute q2 = q1*u |
| Instead of full q2 (which would be up to 514 bits) we ignore the MSb of u |
| and the MSb of q1 and correct this later. This allows using a 256x256 |
| multiplier. |
| => max. length q2': 512 bit |
| q2' = q1[255:0]*u[255:0] = [w20, w19] = w21 * w28 */ |
| bn.mulqacc.z w21.0, w28.0, 0 |
| bn.mulqacc w21.1, w28.0, 64 |
| bn.mulqacc.so w23.L, w21.0, w28.1, 64 |
| bn.mulqacc w21.2, w28.0, 0 |
| bn.mulqacc w21.1, w28.1, 0 |
| bn.mulqacc w21.0, w28.2, 0 |
| bn.mulqacc w21.3, w28.0, 64 |
| bn.mulqacc w21.2, w28.1, 64 |
| bn.mulqacc w21.1, w28.2, 64 |
| bn.mulqacc.so w23.U, w21.0, w28.3, 64 |
| bn.mulqacc w21.3, w28.1, 0 |
| bn.mulqacc w21.2, w28.2, 0 |
| bn.mulqacc w21.1, w28.3, 0 |
| bn.mulqacc w21.3, w28.2, 64 |
| bn.mulqacc.so w24.L, w21.2, w28.3, 64 |
| bn.mulqacc.so w24.U, w21.3, w28.3, 0 |
| bn.add w20, w20, w31 |
| |
| /* q3 = q2 >> 257 |
| In this step, the compensation for the neglected MSbs of q1 and u is |
| carried out underway. To add them in the q2 domain, they would have to be |
| left shifted by 256 bit first. To directly add them we first shift q2' by |
| 256 bit to the right (by dropping the lower 256 bit), perform the |
| additions, and shift the result another bit to the right. |
| |
| /* w25 = q1[256] = x[511:256] >> 255 */ |
| bn.rshi w25, w31, w20 >> 255 |
| |
| /* compensate for neglected MSB of u, by adding full q1 |
| this is unconditional since MSB of u is always 1 |
| [w25, w24] = q2'' <= q2'[511:256] + q1 = [w25, w24] <= w24 + [w25, w21] */ |
| bn.add w24, w24, w21 |
| bn.addc w25, w25, w31 |
| |
| /* compensate for neglected MSB of q1, by conditionally adding u */ |
| /* [w25, w24] = q2''' <= q2'' + [0 or u] = [w25, w24] + w22 */ |
| bn.add w24, w24, w22 |
| bn.addc w25, w25, w31 |
| |
| /* q3 = w21 = q2''' >> 1 */ |
| bn.rshi w21, w25, w24 >> 1 |
| |
| /* [w23, w22] <= q3 * p */ |
| bn.mulqacc.z w29.0, w21.0, 0 |
| bn.mulqacc w29.1, w21.0, 64 |
| bn.mulqacc.so w22.L, w29.0, w21.1, 64 |
| bn.mulqacc w29.2, w21.0, 0 |
| bn.mulqacc w29.1, w21.1, 0 |
| bn.mulqacc w29.0, w21.2, 0 |
| bn.mulqacc w29.3, w21.0, 64 |
| bn.mulqacc w29.2, w21.1, 64 |
| bn.mulqacc w29.1, w21.2, 64 |
| bn.mulqacc.so w22.U, w29.0, w21.3, 64 |
| bn.mulqacc w29.3, w21.1, 0 |
| bn.mulqacc w29.2, w21.2, 0 |
| bn.mulqacc w29.1, w21.3, 0 |
| bn.mulqacc w29.3, w21.2, 64 |
| bn.mulqacc.so w23.L, w29.2, w21.3, 64 |
| bn.mulqacc.so w23.U, w29.3, w21.3, 0 |
| bn.add w23, w23, w31 |
| |
| /* We compute the final remainder r by subtracting the estimate q3 from x. |
| In the generic algorithm, r is already the reduced result or it is off by |
| either p or 2p. For the special case of the modulus of P-256 it can be |
| shown that r can only be off by max p. Therefore, only a single |
| conditional correction is required. |
| [w20, w22] = r <= [w20, w19] - [w23, w22] = x - q3*p */ |
| bn.sub w22, w19, w22 |
| bn.subb w20, w20, w23 |
| |
| /* r cannot be wider than 257 bit. Therefore it is r > p if bit 256 of r is |
| set and we need to subtract the modulus */ |
| bn.sel w21, w29, w31, L |
| bn.sub w21, w22, w21 |
| |
| /* this performs the correction in case r is only 256 bit long but still |
| greater than the modulus */ |
| bn.addm w19, w21, w31 |
| |
| ret |
| |
| |
| /** |
| * Checks if a point is a valid curve point on curve P-256 (secp256r1) |
| * |
| * Returns r = x^3 + ax + b mod p |
| * and s = y^2 mod p |
| * with x,y being the affine coordinates of the curve point |
| * a, b and p being the domain parameters of P-256 |
| * |
| * This routine checks if a point with given x- and y-coordinate is a valid |
| * curve point on P-256. |
| * The routine checks whether the coordinates are a solution of the |
| * Weierstrass equation y^2 = x^3 + ax + b mod p. |
| * The routine makes use of the property that the domain parameter 'a' can be |
| * written as a=-3 for the P-256 curve, hence the routine is limited to P-256. |
| * The routine does not return a boolean result but computes the left side |
| * and the right sight of the Weierstrass equation and leaves the final |
| * comparison to the caller. |
| * The routine runs in constant time. |
| * |
| * Flags: When leaving this subroutine, flags of FG0 depend on an |
| * intermediate result and are not usable after return. |
| * FG1 is not modified in this subroutine. |
| * |
| * @param[in] dmem[12]: dptr_r, pointer to dmem location where right |
| * side result r will be stored |
| * @param[in] dmem[16]: dptr_s, pointer to dmem location where left side |
| * result s will be stored |
| * @param[in] dmem[20]: dptr_x, pointer to dmem location containing affine |
| * x-coordinate of input point |
| * @param[in] dmem[24]: dptr_y, pointer to dmem location containing affine |
| * y-coordinate of input point |
| * @param[in] w27: b, curve domain parameter |
| * @param[in] w29: p, modulus, 2^256 > p > 2^255. |
| * @param[in] w28: u, pre-computed Barrett constant (without u[256]/MSb |
| * of u which is always 1 for the allowed range. |
| * @param[in] w31: all-zero. |
| * @param[in] MOD: p, modulus, 2^256 > p > 2^255. |
| * |
| * clobbered registers: x8, x13, x14, x19, x20, x21, w0, w19 to w25 |
| * clobbered flag groups: FG0 |
| */ |
| p256_isoncurve: |
| |
| addi x3, x0, 0 |
| bn.lid x3, 0(x0) |
| |
| lw x16, 0(x0) |
| lw x17, 4(x0) |
| lw x18, 8(x0) |
| |
| /* load dmem pointer to signature r from dmem: x19 <= dptr_r = dmem[12] */ |
| lw x19, 12(x0) |
| |
| /* load dmem pointer to signature s from dmem, x20 <= dptr_s = dmem[16] */ |
| lw x20, 16(x0) |
| |
| /* load dmem pointer to affine x-coordinate of curve point from dmem: |
| x21 <= dptr_x = dmem[20] */ |
| lw x21, 20(x0) |
| |
| /* load dmem pointer to affine y-coordinate of curve point from dmem: |
| x22 <= dptr_y = dmem[24] */ |
| lw x22, 24(x0) |
| |
| lw x23, 28(x0) |
| |
| /* setup pointers to WREGs */ |
| addi x8, x0, 0 |
| |
| lw x9, 4(x0) |
| lw x10, 8(x0) |
| lw x11, 12(x0) |
| lw x12, 16(x0) |
| |
| /* setup pointers to WREGs */ |
| addi x13, x0, 24 |
| addi x14, x0, 24 |
| |
| lw x15, 28(x0) |
| |
| /* load y-coordinate from dmem |
| w24 = y = dmem[dptr_y] = dmem[x22]] */ |
| bn.lid x14, 0(x22) |
| |
| /* w0 = w19 = y^2 = w24*w24 */ |
| bn.mov w25, w24 |
| jal x1, mod_mul_256x256 |
| bn.mov w0, w19 |
| |
| /* load x-coordinate from dmem |
| w24 = x = dmem[dptr_x] = dmem[x21] */ |
| bn.lid x13, 0(x21) |
| |
| /* w19 = x^2 = w24*w24 */ |
| bn.mov w25, w24 |
| jal x1, mod_mul_256x256 |
| |
| /* reload x-coordinate from dmem */ |
| bn.lid x13, 0(x21) |
| |
| /* w19 = x^3 = x^2 * x = w25*w24 = w19*w24 */ |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| |
| /* reload x-coordinate from dmem */ |
| bn.lid x13, 0(x21) |
| |
| /* for curve P-256, 'a' can be written as a = -3, therefore we subtract |
| x three times from x^3. |
| w19 = x^3 + ax = x^3 - 3x mod p */ |
| bn.subm w19, w19, w24 |
| bn.subm w19, w19, w24 |
| bn.subm w19, w19, w24 |
| |
| /* w24 = x^3 + ax + b = w19 + w27 mod p */ |
| bn.addm w24, w19, w27 |
| |
| /* store results in dmem */ |
| /* dmem[dptr_r] = w24 = x^3 + ax + b mod p */ |
| bn.sid x13, 0(x19) |
| |
| /* dmem[dptr_s] = w0 = y^2 mod p */ |
| bn.sid x8, 0(x20) |
| |
| ret |
| |
| |
| /** |
| * P-256 point addition in projective coordinates |
| * |
| * returns R = (x_r, y_r, z_r) <= P+Q = (x_p, y_p, z_p) + (x_q, y_q, z_q) |
| * with R, P and Q being valid P-256 curve points |
| * in projective coordinates |
| * |
| * This routine adds two valid P-256 curve points in projective space. |
| * Point addition is performed based on the complete formulas of Bosma and |
| * Lenstra for Weierstrass curves as first published in [1] and |
| * optimized in [2]. |
| * The implemented version follows Algorithm 4 of [2] which is an optimized |
| * variant for Weierstrass curves with domain parameter 'a' set to a=-3. |
| * Numbering of the steps below and naming of symbols follows the |
| * terminology of Algorithm 4 of [2]. |
| * The routine is limited to P-256 curve points due to: |
| * - fixed a=-3 domain parameter |
| * - usage of a P-256 optimized Barrett multiplication kernel |
| * This routine runs in constant time. |
| * |
| * [1] https://doi.org/10.1006/jnth.1995.1088 |
| * [2] https://doi.org/10.1007/978-3-662-49890-3_16 |
| * |
| * @param[in] w8: x_p, x-coordinate of input point P |
| * @param[in] w9: y_p, y-coordinate of input point P |
| * @param[in] w10: z_p, z-coordinate of input point P |
| * @param[in] w11: x_q, x-coordinate of input point Q |
| * @param[in] w12: y_q, x-coordinate of input point Q |
| * @param[in] w13: z_q, x-coordinate of input point Q |
| * @param[in] w27: b, curve domain parameter |
| * @param[in] w29: p, modulus, 2^256 > p > 2^255. |
| * @param[in] w28: u, pre-computed Barrett constant (without u[256]/MSb |
| * of u which is always 1 for the allowed range. |
| * @param[in] w31: all-zero. |
| * @param[in] MOD: p, modulus, 2^256 > p > 2^255. |
| * @param[out] w11: x_r, x-coordinate of resulting point R |
| * @param[out] w12: y_r, x-coordinate of resulting point R |
| * @param[out] w13: z_r, x-coordinate of resulting point R |
| * |
| * Flags: When leaving this subroutine, flags of FG0 depend on an |
| * intermediate result and are not usable after return. |
| * FG1 is not modified in this subroutine. |
| * |
| * clobbered registers: w11 to w25 |
| * clobbered flag groups: FG0 |
| */ |
| proj_add: |
| /* mapping of parameters to symbols of [2] (Algorithm 4): |
| X1 = x_p; Y1 = y_p; Z1 = z_p; X2 = x_q; Y2 = y_q; Z2 = z_q |
| X3 = x_r; Y3 = y_r; Z3 = z_r */ |
| |
| /* 1: w14 = t0 <= X1*X2 = w11*w8 */ |
| bn.mov w24, w11 |
| bn.mov w25, w8 |
| jal x1, mod_mul_256x256 |
| bn.mov w14, w19 |
| |
| /* 2: w15 = t1 <= Y1*Y2 = w12*w9 */ |
| bn.mov w24, w12 |
| bn.mov w25, w9 |
| jal x1, mod_mul_256x256 |
| bn.mov w15, w19 |
| |
| /* 3: w16 = t2 <= Z1*Z2 = w13*w10*/ |
| bn.mov w24, w13 |
| bn.mov w25, w10 |
| jal x1, mod_mul_256x256 |
| bn.mov w16, w19 |
| |
| /* 5: w17 = t4 <= X2+Y2 = w11 + w12 */ |
| bn.addm w17, w11, w12 |
| |
| /* 4: w18 = t3 <= X1+Y1 = w8+w9 */ |
| bn.addm w18, w8, w9 |
| |
| /* 6: w19 = t3 <= t3*t4 = w18*w17 */ |
| bn.mov w24, w17 |
| bn.mov w25, w18 |
| jal x1, mod_mul_256x256 |
| |
| /* 7: w18 = t4 <= t0+t1 = w14+w15 */ |
| bn.addm w18, w14, w15 |
| |
| /* 8: w17 = t3 <= t3 - t4 = w19 - w18 */ |
| bn.subm w17, w19, w18 |
| |
| /* 10: w18 = X3 <= Y2 + Z2 = w12 + w13 */ |
| bn.addm w18, w12, w13 |
| |
| /* 9: w19 = t4 <= Y1 + Z1 = w9 + w10 */ |
| bn.addm w19, w9, w10 |
| |
| /* 11: w18 = t4 <= t4 * X3 = w19 * w18 */ |
| bn.mov w24, w18 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| bn.mov w18, w19 |
| |
| /* 12: w19 = X3 <= t1 + t2 = w15 + w16 */ |
| bn.addm w19, w15, w16 |
| |
| /* 13: w18 = t4 <= t4 - X3 = w18 + w19 */ |
| bn.subm w18, w18, w19 |
| |
| /* 15: w19 = Y3 <= X2 + Z2 = w11 + w13 */ |
| bn.addm w19, w11, w13 |
| |
| /* 14: w12 = X3 <= X1 + Z1 = w8 + w10 */ |
| bn.addm w12, w8, w10 |
| |
| /* 16: w11 = X3 <= X3 * Y3 = w12 * w19 */ |
| bn.mov w24, w19 |
| bn.mov w25, w12 |
| jal x1, mod_mul_256x256 |
| bn.mov w11, w19 |
| |
| /* 17: w12 = Y3 <= t0 + t2 = w14 + w16 */ |
| bn.addm w12, w14, w16 |
| |
| /* 18: w12 = Y3 <= X3 - Y3 = w11 - w12 */ |
| bn.subm w12, w11, w12 |
| |
| /* 19: w19 = Z3 <= b * t2 = w27 * w16 */ |
| bn.mov w24, w27 |
| bn.mov w25, w16 |
| jal x1, mod_mul_256x256 |
| |
| /* 20: w11 = X3 <= Y3 -Z3 = w12 - w19 */ |
| bn.subm w11, w12, w19 |
| |
| /* 21: w13 = Z3 <= X3 + X3 = w11 + w11 */ |
| bn.addm w13, w11, w11 |
| |
| /* 22: w11 = X3 <= w11 + w13 = X3 + Z3 */ |
| bn.addm w11, w11, w13 |
| |
| /* 23: w13 = Z3 <= t1 - X3 = w15 - w11 */ |
| bn.subm w13, w15, w11 |
| |
| /* 24: w11 = X3 <= t1 + X3 = w15 + w11 */ |
| bn.addm w11, w15, w11 |
| |
| /* 25: w19 = Y3 <= w27 * w12 = b * Y3 */ |
| bn.mov w24, w27 |
| bn.mov w25, w12 |
| jal x1, mod_mul_256x256 |
| |
| /* 26: w15 = t1 <= t2 + t2 = w16 + w16 */ |
| bn.addm w15, w16, w16 |
| |
| /* 27: w16 = t2 <= t1 + t2 = w15 + w16 */ |
| bn.addm w16, w15, w16 |
| |
| /* 28: w12 = Y3 <= Y3 - t2 = w19 - w16 */ |
| bn.subm w12, w19, w16 |
| |
| /* 29: w12 = Y3 <= Y3 - t0 = w12 - w14 */ |
| bn.subm w12, w12, w14 |
| |
| /* 30: w15 = t1 <= Y3 + Y3 = w12 + w12 */ |
| bn.addm w15, w12, w12 |
| |
| /* 31: w12 = Y3 <= t1 + Y3 = w15 + w12*/ |
| bn.addm w12, w15, w12 |
| |
| /* 32: w15 = t1 <= t0 + t0 = w14 + w14 */ |
| bn.addm w15, w14, w14 |
| |
| /* 33: w14 = t0 <= t1 + t0 = w15 + w14 */ |
| bn.addm w14, w15, w14 |
| |
| /* 34: w14 = t0 <= t0 - t2 = w14 - w16 */ |
| bn.subm w14, w14, w16 |
| |
| /* 35: w15 = t1 <= t4 * Y3 = w18 * w12 */ |
| bn.mov w24, w18 |
| bn.mov w25, w12 |
| jal x1, mod_mul_256x256 |
| bn.mov w15, w19 |
| |
| /* 36: w16 = t2 <= t0 * Y3 = w14 * w12 */ |
| bn.mov w24, w14 |
| bn.mov w25, w12 |
| jal x1, mod_mul_256x256 |
| bn.mov w16, w19 |
| |
| /* 37: w12 = Y3 <= X3 * Z3 = w11 * w13 */ |
| bn.mov w24, w11 |
| bn.mov w25, w13 |
| jal x1, mod_mul_256x256 |
| |
| /* 38: w12 = Y3 <= Y3 + t2 = w19 + w16 */ |
| bn.addm w12, w19, w16 |
| |
| /* 39: w19 = X3 <= t3 * X3 = w17 * w11 */ |
| bn.mov w24, w17 |
| bn.mov w25, w11 |
| jal x1, mod_mul_256x256 |
| |
| /* 40: w11 = X3 <= X3 - t1 = w19 - w15 */ |
| bn.subm w11, w19, w15 |
| |
| /* 41: w13 = Z3 <= t4 * Z3 = w18 * w13 */ |
| bn.mov w24, w18 |
| bn.mov w25, w13 |
| jal x1, mod_mul_256x256 |
| bn.mov w13, w19 |
| |
| /* 42: w19 = t1 <= t3 * t0 = w17 * w14 */ |
| bn.mov w24, w17 |
| bn.mov w25, w14 |
| jal x1, mod_mul_256x256 |
| |
| /* 43: w13 = Z3 <= Z3 + t1 = w13 + w19 */ |
| bn.addm w13, w13, w19 |
| |
| ret |
| |
| |
| /** |
| * Convert projective coordinates of a P-256 curve point to affine coordinates |
| * |
| * returns P = (x_a, y_a) = (x/z mod p, y/z mod p) |
| * with P being a valid P-256 curve point |
| * x_a and y_a being the affine coordinates of said curve point |
| * x, y and z being a set of projective coordinates of said point |
| * and p being the modulus of the P-256 underlying finite field. |
| * |
| * This routine computes the affine coordinates for a set of projective |
| * coordinates of a valid P-256 curve point. The routine performs the required |
| * divisions by computing the multiplicative modular inverse of the |
| * projective z-coordinate in the underlying finite field of the P-256 curve. |
| * For inverse computation Fermat's little theorem is used, i.e. |
| * we compute z^-1 = z^(p-2) mod p. |
| * For exponentiation a 27 step addition chain is used. |
| * This addition chain is (presumably?) the shortest addition chain known as |
| * of today for the exponent exp = p - 2 = 2^256 - 2^224 + 2^6 + 2^64 - 1 - 2. |
| * Origin of the chain can not fully be traced. [1] attributes it to a specific |
| * patch to OpenSLL. The same addition chain is used in the OpenSSL and |
| * BoringSSL crypto libraries. |
| * This routine runs in constant time. |
| * |
| * [1] https://doi.org/10.1007/s13389-014-0090-x |
| * https://eprint.iacr.org/2013/816.pdf |
| * |
| * Flags: When leaving this subroutine, the M, L and Z flags of FG0 depend on |
| * the computed affine y-coordinate. |
| * |
| * @param[in] w8: x, x-coordinate of curve point (projective) |
| * @param[in] w9: y, y-coordinate of curve point (projective) |
| * @param[in] w10: z, z-coordinate of curve point (projective) |
| * @param[in] w29: p, modulus, 2^256 > p > 2^255. |
| * @param[in] w28: u, pre-computed Barrett constant (without u[256]/MSb |
| * of u which is always 1 for the allowed range. |
| * @param[in] MOD: p, modulus of the finite field of P-256 |
| * @param[out] w11: x_a, x-coordinate of curve point (affine) |
| * @param[out] w12: y_a, y-coordinate of curve point (affine) |
| * |
| * clobbered registers: w10 to w19, w24, w25 |
| * clobbered flag groups: FG0 |
| */ |
| proj_to_affine: |
| |
| /* 1: exp = 0x1 */ |
| bn.addm w10, w10, w31 |
| |
| /* 2: exp = 0x2 = 2*0x1 */ |
| bn.mov w24, w10 |
| bn.mov w25, w10 |
| jal x1, mod_mul_256x256 |
| |
| /* 3: exp = 0x3 = 0x2+0x1 */ |
| bn.mov w24, w19 |
| bn.mov w25, w10 |
| jal x1, mod_mul_256x256 |
| bn.mov w12, w19 |
| |
| /* 4: exp = 0x6 = 2*0x3 */ |
| bn.mov w24, w19 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| |
| /* 5: exp = 0xc = 2*0x6 */ |
| bn.mov w24, w19 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| |
| /* 6: exp = 0xf = 0xc+0x3 */ |
| bn.mov w24, w19 |
| bn.mov w25, w12 |
| jal x1, mod_mul_256x256 |
| bn.mov w13, w19 |
| |
| /* 7: exp = 0xf0 = 16*0xf */ |
| loopi 4, 4 |
| bn.mov w24, w19 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| nop |
| |
| /* 8: exp = 0xff = 0xf0+0xf */ |
| bn.mov w24, w19 |
| bn.mov w25, w13 |
| jal x1, mod_mul_256x256 |
| bn.mov w14, w19 |
| |
| /* 9: exp = 0xff00 = 256*0xff */ |
| loopi 8, 4 |
| bn.mov w24, w19 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| nop |
| |
| /* 10: exp = 0xffff = 0xff00+0xff */ |
| bn.mov w24, w19 |
| bn.mov w25, w14 |
| jal x1, mod_mul_256x256 |
| bn.mov w15, w19 |
| |
| /* 11: exp = 0xffff0000 = 2^16*0xffff */ |
| loopi 16, 4 |
| bn.mov w24, w19 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| nop |
| |
| /* 12: exp = 0xffffffff = 0xffff0000+0xffff */ |
| bn.mov w24, w19 |
| bn.mov w25, w15 |
| jal x1, mod_mul_256x256 |
| bn.mov w16, w19 |
| |
| /* 13: exp = 0xffffffff00000000 = 2^32*0xffffffff */ |
| loopi 32, 4 |
| bn.mov w24, w19 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| nop |
| bn.mov w17, w19 |
| |
| /* 14: exp = 0xffffffff00000001 = 0xffffffff00000000+0x1 */ |
| bn.mov w24, w10 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| |
| /* 15: exp = |
| 0xffffffff00000001000000000000000000000000000000000000000000000000 |
| = 2^192*0xffffffff00000001 */ |
| loopi 192, 4 |
| bn.mov w24, w19 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| nop |
| bn.mov w18, w19 |
| |
| /* 16: exp = 0xffffffffffffffff = 0xffffffff00000000+0xffffffff */ |
| bn.mov w24, w17 |
| bn.mov w25, w16 |
| jal x1, mod_mul_256x256 |
| |
| /* 17: exp = 0xffffffffffffffff0000 = 2^16*0xffffffffffffffff */ |
| loopi 16, 4 |
| bn.mov w24, w19 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| nop |
| |
| /* 18: exp = 0xffffffffffffffffffff = 0xffffffffffffffff0000+0xffff */ |
| bn.mov w24, w15 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| |
| /* 19: exp = 0xffffffffffffffffffff00 = 256*0xffffffffffffffffffff */ |
| loopi 8, 4 |
| bn.mov w24, w19 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| nop |
| |
| /* 20: exp = 0xffffffffffffffffffffff = 0xffffffffffffffffffff00+0xff */ |
| bn.mov w24, w14 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| |
| /* 21: exp = 0xffffffffffffffffffffff0 = 16*0xffffffffffffffffffffff */ |
| loopi 4, 4 |
| bn.mov w24, w19 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| nop |
| |
| /* 22: exp = 0xfffffffffffffffffffffff = 0xffffffffffffffffffffff0+0xf */ |
| bn.mov w24, w13 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| |
| /* 23: exp = 0x3ffffffffffffffffffffffc = 4*0xfffffffffffffffffffffff */ |
| loopi 2, 4 |
| bn.mov w24, w19 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| nop |
| |
| /* 24: exp = 0x3fffffffffffffffffffffff = 0x3ffffffffffffffffffffffc+0x3 */ |
| bn.mov w24, w12 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| |
| /* 25: exp = 0xfffffffffffffffffffffffc = 4*0x3fffffffffffffffffffffff */ |
| loopi 2, 4 |
| bn.mov w24, w19 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| nop |
| |
| /* 26: exp = 0xfffffffffffffffffffffffd = 0xfffffffffffffffffffffffc+0x1 */ |
| bn.mov w24, w10 |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| |
| /* 27: exp = p-2 |
| = 0xffffffff00000001000000000000000000000000fffffffffffffffffffffffd |
| = 0xfffffffffffffffffffffffd |
| + 0xffffffff00000001000000000000000000000000000000000000000000000000 |
| w14 = z^exp = z^(p-2) = z^-1 mod p */ |
| bn.mov w24, w19 |
| bn.mov w25, w18 |
| jal x1, mod_mul_256x256 |
| bn.mov w14, w19 |
| |
| /* convert x-coordinate to affine |
| w11 = x_a = x/z = x * z^(-1) = w8 * w14 */ |
| bn.mov w24, w8 |
| bn.mov w25, w14 |
| jal x1, mod_mul_256x256 |
| bn.mov w11, w19 |
| |
| /* convert y-coordinate to affine |
| w12 = y_a = y/z = y * z^(-1) = w9 * w14 */ |
| bn.mov w24, w9 |
| bn.mov w25, w14 |
| jal x1, mod_mul_256x256 |
| bn.mov w12, w19 |
| |
| ret |
| |
| |
| /** |
| * Variable time modular multiplicative inverse computation |
| * |
| * returns x_inv = x^-1 mod m |
| * |
| * This routine computes the modular multiplicative inverse for any x < m in |
| * the field GF(m). |
| * For inverse computation Fermat's little theorem is used, i.e. |
| * we compute x^-1 = x^(m-2) mod m. |
| * For exponentiation we use a standard, variable time (!) square and multiply |
| * algorithm. |
| * |
| * @param[in] w0: x, a 256 bit operand with x < m |
| * @param[in] w29: m, modulus, 2^256 > m > 2^255. |
| * @param[in] w28: u, lower 256 bit of pre-computed Barrett constant |
| * @param[in] w30, constant 1 |
| * @param[in] w31, all-zero |
| * @param[in] MOD: m, modulus |
| * @param[out] w1: x_inv, modular multiplicative inverse |
| * |
| * Flags: When leaving this subroutine, flags of FG0 depend on a |
| * potentially discarded intermediate result and are not usable after |
| * return. |
| * FG1 is not modified in this subroutine. |
| * |
| * clobbered registers: w1, w2, w3, w19, w24, w25 |
| * clobbered flag groups: FG0 |
| */ |
| mod_inv: |
| |
| /* subtract 2 from modulus for Fermat's little theorem |
| w2 = MOD - 2 = m - 2 */ |
| bn.wsrr w2, 0 |
| bn.subi w2, w2, 2 |
| |
| /* init square and multiply: w1 = 1 */ |
| bn.mov w1, w30 |
| |
| /* square and multiply loop */ |
| loopi 256, 14 |
| |
| /* square: w3 = w19 = w24*w25 = w1^2 mod m */ |
| bn.mov w24, w1 |
| bn.mov w25, w1 |
| jal x1, mod_mul_256x256 |
| bn.mov w3, w19 |
| |
| /* shift MSB into carry flag |
| w2 = 2*w2 = w2 << 1 */ |
| bn.add w2, w2, w2 |
| |
| /* skip multiplication if C flag not set */ |
| bn.sel w1, w1, w3, C |
| csrrs x2, 1984, x0 |
| andi x2, x2, 1 |
| beq x2, x0, nomul |
| |
| /* multiply: w1 = w19 = w24*w25 = w3*w0 mod m */ |
| bn.mov w24, w3 |
| bn.mov w25, w0 |
| jal x1, mod_mul_256x256 |
| bn.mov w1, w19 |
| |
| nomul: |
| nop |
| |
| ret |
| |
| |
| /** |
| * Fetch curve point from dmem and randomize z-coordinate |
| * |
| * returns P = (x, y, z) = (x_a*z, y_a*z, z) |
| * with P being a valid P-256 curve point in projective coordinates |
| * x_a and y_a being the affine coordinates as fetched from dmem |
| * z being a randomized z-coordinate |
| * |
| * This routines fetches the affine x- and y-coordinates of a curve point from |
| * dmem and computes a valid set of projective coordinates. The z-coordinate is |
| * randomized and x and y are scaled appropriately. |
| * This routine runs in constant time. |
| * |
| * @param[in] x10: constant 24 |
| * @param[in] x21: dptr_x, pointer to dmem location containing affine |
| * x-coordinate of input point |
| * @param[in] x22: dptr_y, pointer to dmem location containing affine |
| * y-coordinate of input point |
| * @param[in] w28: u, lower 256 bit of Barrett constant for curve P-256 |
| * @param[in] w29: p, modulus of P-256 underlying finite field |
| * @param[in] w31: all-zero |
| * @param[in] MOD: p, modulus of P-256 underlying finite field |
| * @param[out] w26: z, random projective z-coordinate |
| * @param[out] w6: x, projective x-coordinate |
| * @param[out] w7: y, projective y-coordinate |
| * |
| * Flags: When leaving this subroutine, the M, L and Z flags of FG0 depend on |
| * the scaled projective y-coordinate. |
| * |
| * clobbered registers: w2, w6, w7, w19, w24, w25, w26 |
| * clobbered flag groups: FG0 |
| */ |
| fetch_proj_randomize: |
| |
| /* get random number */ |
| bn.wsrr w2, 1 |
| |
| /* reduce random number |
| w26 = z <= w2 mod p */ |
| bn.addm w26, w2, w31 |
| |
| /* fetch x-coordinate from dmem |
| w24 = x_a <= dmem[x22] = dmem[dptr_x] */ |
| bn.lid x10, 0(x21) |
| |
| /* scale x-coordinate |
| w6 = x <= w24*w26 = x_a*z mod p */ |
| bn.mov w25, w26 |
| jal x1, mod_mul_256x256 |
| bn.mov w6, w19 |
| |
| /* fetch y-coordinate from dmem |
| w24 = y_a <= dmem[x22] = dmem[dptr_y] */ |
| bn.lid x10, 0(x22) |
| |
| /* scale y-coordinate |
| w7 = y <= w24*w26 = y_a*z mod p */ |
| bn.mov w25, w26 |
| jal x1, mod_mul_256x256 |
| bn.mov w7, w19 |
| |
| ret |
| |
| |
| /** |
| * P-256 point doubling in projective space |
| * |
| * returns R = (x_r, y_r, z_r) <= 2*P = 2*(x_p, y_p, z_p) |
| * with R, P being valid P-256 curve points |
| * |
| * This routines doubles a given P-256 curve point in projective coordinate. |
| * Internally this routine makes use of the point addition routine and |
| * adds the point to itself. |
| * This routine runs in constant time. |
| * |
| * @param[in] w8: x_p, x-coordinate of input point |
| * @param[in] w9: y_p, y-coordinate of input point |
| * @param[in] w10: z_p, z-coordinate of input point |
| * @param[in] w27: b, curve domain parameter |
| * @param[in] w29: p, p, modulus of P-256 underlying finite field |
| * @param[in] w28: u, u, lower 256 bit of Barrett constant for curve P-256 |
| * @param[in] w31: all-zero. |
| * @param[in] MOD: p, modulus of P-256 underlying finite field |
| * @param[out] w11: x_r, x-coordinate of resulting point |
| * @param[out] w12: y_r, y-coordinate of resulting point |
| * @param[out] w13: z_r, z-coordinate of resulting point |
| * |
| * Flags: When leaving this subroutine, flags of FG0 depend on an |
| * intermediate result and are not usable after return. |
| * FG1 is not modified in this subroutine. |
| * |
| * clobbered registers: w11 to w25 |
| * clobbered flag groups: FG0 |
| */ |
| proj_double: |
| |
| /* Q = (x_q, y_q, z_q) = (w11, w12, w13) <= P = (x_p, y_p, z_p) |
| = (w8, w9, w10) */ |
| bn.mov w11, w8 |
| bn.mov w12, w9 |
| bn.mov w13, w10 |
| |
| /* R = (x_r, y_r, z_r) = (w11, w12, w13) = P+Q |
| = (w8, w9, w10) + (w11, w12, w13) = (x_p, y_p, z_p) + (x_q, y_q, z_q) */ |
| jal x1, proj_add |
| |
| ret |
| |
| |
| /** |
| * Setup Barrett parameters for order of base point of P-256 |
| * |
| * Loads n, ther order of the base point G of P-256 in the modulus register. |
| * Loads the matching Barrett constant u = floor(2^512/n)[255:0]. |
| * |
| * This routine runs in constant time. |
| * |
| * Flags: This routine does not modify any flag group |
| * |
| * @param[out] w29: n, order of base point G of P-256 |
| * @param[out] w28: u_n, lower 256 bit of Barrett constant base point order |
| * @param[out] MOD: n, order of base point G of P-256 |
| * |
| * clobbered registers: x2, w28, w29 |
| * clobbered flag groups: none |
| */ |
| setup_barrett_n: |
| /* load order of base point G of P-256 |
| w29 = n = |
| 0XFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551 */ |
| addi x2, x0, 0 |
| sw x2, 632(x0) |
| addi x2, x2, -1 |
| sw x2, 624(x0) |
| sw x2, 628(x0) |
| sw x2, 636(x0) |
| lui x2, 1033778 |
| addi x2, x2, 1361 |
| sw x2, 608(x0) |
| lui x2, 998301 |
| addi x2, x2, -1342 |
| sw x2, 612(x0) |
| lui x2, 684410 |
| addi x2, x2, -380 |
| sw x2, 616(x0) |
| lui x2, 773744 |
| addi x2, x2, -1363 |
| sw x2, 620(x0) |
| addi x2, x0, 29 |
| bn.lid x2, 608(x0) |
| |
| /* store n to MOD WSR */ |
| bn.wsrw 0, w29 |
| |
| /* load Barrett constant u (lower 256 bit only) |
| w28 = u_n = floor(2^512/n)[255:0] = |
| 0X00000000FFFFFFFFFFFFFFFEFFFFFFFF43190552DF1A6C21012FFD85EEDF9BFE */ |
| addi x2, x0, 0 |
| sw x2, 668(x0) |
| addi x2, x0, -1 |
| sw x2, 656(x0) |
| sw x2, 664(x0) |
| addi x2, x0, -2 |
| sw x2, 660(x0) |
| lui x2, 978426 |
| addi x2, x2, -1026 |
| sw x2, 640(x0) |
| lui x2, 4864 |
| addi x2, x2, -635 |
| sw x2, 644(x0) |
| lui x2, 913831 |
| addi x2, x2, -991 |
| sw x2, 648(x0) |
| lui x2, 274832 |
| addi x2, x2, 1362 |
| sw x2, 652(x0) |
| addi x2, x0, 28 |
| bn.lid x2, 640(x0) |
| |
| ret |
| |
| |
| /** |
| * P-256 scalar point multiplication in affine space |
| * |
| * returns R = k*P = k*(x_p, y_p) |
| * with R, P being valid P-256 curve points in affine coordinates |
| * k being a 256 bit scalar |
| * |
| * This routines performs scalar multiplication based on the group laws |
| * of Weierstrass curves. |
| * A constant time double-and-add algorithm (sometimes referred to as |
| * double-and-add-always) is used. |
| * Due to the P-256 optimized implementations of the called routines for |
| * point addition and doubling, this routine is limited to P-256. |
| * The routine makes use of blinding by additive splitting the |
| * exponent/scalar k into a random number (rnd) and rnd-k. The double-and-add |
| * loop operates on both shares in parallel applying Shamir's trick. |
| * |
| * @param[in] x9: constant 1 |
| * @param[in] x10: constant 24 |
| * @param[in] x17: dRnd, pointer to location in dmem containing random number |
| * to be used for additive splitting of scalar |
| * @param[in] x21: dptr_x, pointer to affine x-coordinate in dmem |
| * @param[in] x22: dptr_y, pointer to affine y-coordinate in dmem |
| * @param[in] w0: k, scalar for multiplication |
| * @param[in] w27: b, curve domain parameter |
| * @param[in] w28: u, pre-computed Barrett constant (without u[256]/MSb |
| * of u which is always 1 for the allowed range. |
| * @param[in] w29: p, modulus, 2^256 > p > 2^255. |
| * @param[in] w30: constant 1 |
| * @param[in] w31: all-zero |
| * @param[in] MOD: p, modulus, 2^256 > p > 2^255. |
| * @param[out] w11: x_r, affine x-coordinate of resulting point |
| * @param[out] w12: y_r, affine y-coordinate of resulting point |
| * |
| * Flags: When leaving this subroutine, the M, L and Z flags of FG0 depend on |
| * the computed affine y-coordinate. |
| * |
| * clobbered registers: w0 to w25 |
| * clobbered flag groups: FG0 |
| */ |
| scalar_mult_int: |
| |
| /* setup domain parameter n (order of base point G) as the modulus */ |
| jal x1, setup_barrett_n |
| |
| /* fetch externally supplied random number from dmem |
| w1 = dmem[dptr_rnd] = rnd */ |
| bn.lid x9, 0(x17) |
| |
| /* 1st share (reduced rnd) |
| rnd = w1 <= rnd mod n */ |
| bn.addm w1, w1, w31 |
| |
| /* 2nd share (k-rnd) |
| w0 = w0 - w1 = k - rnd mod n */ |
| bn.subm w0, w0, w1 |
| |
| /* setup Barrett parameter and modulus for P-256 underlying field */ |
| jal x1, setup_barrett_p |
| |
| /* get randomized projective coodinates of curve point |
| P = (x_p, y_p, z_p) = (w8, w9, w10) = (w6, w7, w26) = |
| (x*z mod p, y*z mod p, z) */ |
| jal x1, fetch_proj_randomize |
| bn.mov w8, w6 |
| bn.mov w9, w7 |
| bn.mov w10, w26 |
| |
| /* Init 2P, this will be used for the addition part in the double-and-add |
| loop when the bit at the current index is 1 for both shares of the scalar. |
| 2P = (w3, w4, w5) <= (w11, w12, w13) <= 2*(w8, w9, w10) = 2*P */ |
| jal x1, proj_double |
| bn.mov w3, w11 |
| bn.mov w4, w12 |
| bn.mov w5, w13 |
| |
| /* init double-and-add with point in infinity |
| Q = (w8, w9, w10) <= (0, 1, 0) */ |
| bn.mov w8, w31 |
| bn.mov w9, w30 |
| bn.mov w10, w31 |
| |
| /* double-and-add loop with decreasing index */ |
| loopi 256, 32 |
| |
| /* double point Q |
| Q = (w11, w12, w13) <= 2*(w8, w9, w10) = 2*Q */ |
| jal x1, proj_double |
| |
| |
| /* re-fetch and randomize P again |
| P = (w6, w7, w26) */ |
| jal x1, fetch_proj_randomize |
| |
| /* probe if MSb of either of the two scalars (rnd or k-rnd) but not both |
| is 1. |
| If only one MSb is set, select P for addition |
| If both MSbs are set, select 2P for addition |
| (If neither MSB is set, also 2P will be selected but this will be |
| discarded late) */ |
| bn.xor w8, w0, w1 |
| |
| /* P = (w8, w9, w10) |
| <= (w0[255] xor w1[256])?P=(w6, w7, w26):2P=(w3, w4, w5) */ |
| bn.sel w8, w6, w3, M |
| bn.sel w9, w7, w4, M |
| bn.sel w10, w26, w5, M |
| |
| /* save doubling result to survive follow-up subroutine call |
| Q = (w2, w6, w7) <= (w11, w12, w13) */ |
| bn.mov w2, w11 |
| bn.mov w6, w12 |
| bn.mov w7, w13 |
| |
| /* add points |
| Q+P = (w11, w12, w13) <= (w11, w12, w13) + (w8, w9, w10) */ |
| jal x1, proj_add |
| |
| /* probe if MSb of either one or both of the two |
| scalars (rnd or k-rnd) is 1.*/ |
| bn.or w8, w0, w1 |
| |
| /* select doubling result (Q) or addition result (Q+P) |
| Q = w0[255] or w1[255]?Q_a=(w11, w12, w13):Q=(w2, w6, w7) */ |
| bn.sel w8, w11, w2, M |
| bn.sel w9, w12, w6, M |
| bn.sel w10, w13, w7, M |
| |
| /* rotate both scalars left 1 bit */ |
| bn.rshi w0, w0, w0 >> 255 |
| bn.rshi w1, w1, w1 >> 255 |
| |
| /* init regs with random numbers */ |
| bn.wsrr w11, 1 |
| bn.wsrr w12, 1 |
| bn.wsrr w13, 1 |
| |
| /* get a fresh random number and scale the coordinates of |
| 2P = (w3, w4, w5) (scaling each projective coordinate with same |
| factor results in same point) */ |
| bn.wsrr w2, 1 |
| |
| /* w3 = w3 * w2 */ |
| bn.mov w24, w3 |
| bn.mov w25, w2 |
| jal x1, mod_mul_256x256 |
| bn.mov w3, w19 |
| |
| /* w4 = w4 * w2 */ |
| bn.mov w24, w4 |
| bn.mov w25, w2 |
| jal x1, mod_mul_256x256 |
| bn.mov w4, w19 |
| |
| /* w5 = w5 * w2 */ |
| bn.mov w24, w5 |
| bn.mov w25, w2 |
| jal x1, mod_mul_256x256 |
| bn.mov w5, w19 |
| |
| /* convert back to affine coordinates |
| R = (x_a, y_a) = (w11, w12) */ |
| jal x1, proj_to_affine |
| |
| ret |
| |
| |
| /** |
| * Load base points of P-256 |
| * |
| * Flags: This routine does not modify any flag group |
| * |
| * @param[out] w8: x_g, base point affine x-coordinate |
| * @param[out] w9: y_g, base point affine y-coordinate |
| * |
| * clobbered registers: x2, w8, w9 |
| * clobbered flag groups: none |
| */ |
| load_basepoint: |
| /* load base point x-coordinate |
| w8 = x_g = |
| 0X6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296 */ |
| lui x2, 887180 |
| addi x2, x2, 662 |
| sw x2, 672(x0) |
| lui x2, 1002004 |
| addi x2, x2, -1723 |
| sw x2, 676(x0) |
| lui x2, 188083 |
| addi x2, x2, 928 |
| sw x2, 680(x0) |
| lui x2, 487480 |
| addi x2, x2, -639 |
| sw x2, 684(x0) |
| lui x2, 408132 |
| addi x2, x2, 242 |
| sw x2, 688(x0) |
| lui x2, 1018830 |
| addi x2, x2, 1765 |
| sw x2, 692(x0) |
| lui x2, 922308 |
| addi x2, x2, 583 |
| sw x2, 696(x0) |
| lui x2, 438653 |
| addi x2, x2, 498 |
| sw x2, 700(x0) |
| addi x2, x0, 8 |
| bn.lid x2, 672(x0) |
| |
| /* load base point y-coordinate |
| w9 = y_g = |
| 0X4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5 */ |
| lui x2, 228341 |
| addi x2, x2, 501 |
| sw x2, 704(x0) |
| lui x2, 834404 |
| addi x2, x2, 104 |
| sw x2, 708(x0) |
| lui x2, 439062 |
| addi x2, x2, -306 |
| sw x2, 712(x0) |
| lui x2, 179427 |
| addi x2, x2, 855 |
| sw x2, 716(x0) |
| lui x2, 508154 |
| addi x2, x2, -490 |
| sw x2, 720(x0) |
| lui x2, 585343 |
| addi x2, x2, -1206 |
| sw x2, 724(x0) |
| lui x2, 1040808 |
| addi x2, x2, -101 |
| sw x2, 728(x0) |
| lui x2, 327220 |
| addi x2, x2, 738 |
| sw x2, 732(x0) |
| addi x2, x0, 9 |
| bn.lid x2, 704(x0) |
| |
| ret |
| |
| |
| /** |
| * P-256 ECDSA signature generation |
| * |
| * returns the signature as the pair r, s with |
| * r = x_1 mod n |
| * and s = k^(-1)(msg + r*d) mod n |
| * with x_1 being the affine x-coordinate of the curve point k*G, |
| * where G is the curve's base point. |
| * k being a supplied secret random number, |
| * n being the order of the base point G of P-256, |
| * msg being the msg to be signed, |
| * d being the private key. |
| * |
| * This routine runs in constant time. |
| * |
| * @param[in] dmem[0]: dptr_k, pointer to a 256 bit random secret in dmem |
| * @param[in] dmem[4]: dptr_rnd, pointer to location in dmem containing random |
| * number for blinding |
| * @param[in] dmem[8]: dptr_msg, pointer to the message to be signed in dmem |
| * @param[in] dmem[12]: dptr_r, pointer to dmem location where s component |
| * of signature will be placed |
| * @param[in] dmem[16]: dptr_s, pointer to dmem location where r component |
| * of signature will be placed |
| * @param[in] dmem[28]: dptr_d, pointer to private key d in dmem |
| * |
| * Flags: When leaving this subroutine, the M, L and Z flags of FG0 depend on |
| * the computed affine y-coordinate. |
| * |
| * clobbered registers: x3, x8 to x23, w0 to w25 |
| * clobbered flag groups: FG0 |
| */ |
| p256_sign: |
| |
| addi x0, x0, 0 |
| addi x3, x0, 0 |
| bn.lid x3, 0(x0) |
| |
| /* load dmem pointer to secret random number k in dmem |
| x16 <= dptr_k = dmem[0]*/ |
| lw x16, 0(x0) |
| |
| /* load dmem pointer to random number for blinding rnd in dmem: |
| x17 <= dptr_rnd = dmem[4] */ |
| lw x17, 4(x0) |
| |
| /* load dmem pointer to message msg in dmem: x18 <= dptr_msg = dmem[8] */ |
| lw x18, 8(x0) |
| |
| /* load dmem pointer to signature r in dmem: x19 <= dptr_r = dmem[12] */ |
| lw x19, 12(x0) |
| |
| /* load dmem pointer to signature s in dmem: x20 <= dptr_s = dmem[16] */ |
| lw x20, 16(x0) |
| |
| /* load dmem pointer to affine x-coordinate in dmem: |
| x21 <= dptr_x = dmem[20] */ |
| lw x21, 20(x0) |
| |
| /* load dmem pointer to affine y-coordinate in dmem: |
| x22 <= dptr_y = dmem[24] */ |
| lw x22, 24(x0) |
| |
| /* load dmem pointer to private key d in dmem: dD = x15 <= dmem[28] */ |
| lw x23, 28(x0) |
| |
| /* setup pointers into reg file */ |
| addi x8, x0, 0 |
| addi x9, x0, 1 |
| addi x10, x0, 24 |
| |
| /* setup more dmem pointers */ |
| lw x11, 12(x0) |
| |
| /* setup pointers into reg file */ |
| addi x12, x0, 8 |
| addi x13, x0, 9 |
| |
| /* load dmem pointer to affine y-coordinate in dmem: x14 <= dptr_y = dmem[24] */ |
| lw x14, 24(x0) |
| |
| /* load dmem pointer to private key d in dmem: x15 <= dptr_d = dmem[28] */ |
| lw x15, 28(x0) |
| |
| /* load base point G affine coordinates: G = (w8, w9) <= (x_g, y_g) */ |
| jal x1, load_basepoint |
| |
| /* store affine base point coordinates in dmem |
| dmem[dptr_x] = w8; dmem[dptr_y] = w9 */ |
| bn.sid x12, 0(x21) |
| bn.sid x13, 0(x22) |
| |
| /* load private key d from dmem: w0 = dmem[dptr_d] */ |
| addi x0, x0, 0 |
| bn.lid x8, 0(x16) |
| |
| /* scalar multiplication with base point |
| (x_1, y_1) = (w11, w12) <= d*G = w0*(dmem[dptr_x], dmem[dptr_y]) */ |
| jal x1, scalar_mult_int |
| |
| /* setup modulus n */ |
| jal x1, setup_barrett_n |
| |
| /* load secret random number k from dmem: w0 <= k = dmem[dptr_k] */ |
| bn.lid x8, 0(x16) |
| |
| /* modular multiplicative inverse of k |
| w1 <= k^-1 mod n */ |
| jal x1, mod_inv |
| |
| /* w19 = k^-1*d mod n; w24 = d = dmem[dptr_d] */ |
| bn.lid x10, 0(x23) |
| bn.mov w25, w1 |
| jal x1, mod_mul_256x256 |
| |
| /* w24 = r <= w11 mod n */ |
| bn.addm w24, w11, w31 |
| |
| /* store r of signature in dmem: dmem[dptr_r] <= r = w25 */ |
| bn.sid x10, 0(x19) |
| |
| addi x0, x0, 0 |
| |
| /* w0 = w19 <= w24*w25 = w24*w19 = r*k^-1*d mod n */ |
| bn.mov w25, w19 |
| jal x1, mod_mul_256x256 |
| bn.mov w0, w19 |
| |
| /* load message from dmem: w24 = msg <= dmem[dptr_msg] = dmem[x18] */ |
| bn.lid x10, 0(x18) |
| |
| /* w19 = k^-1*msg <= w25*w24 = w1*w24 mod n */ |
| bn.mov w25, w1 |
| jal x1, mod_mul_256x256 |
| |
| /* w0 = s <= w19 + w0 = d*msg + r*d mod n */ |
| bn.addm w0, w19, w0 |
| |
| /* store s of signature in dmem: dmem[dptr_s] <= s = w0 */ |
| bn.sid x8, 0(x20) |
| |
| jal x1, setup_barrett_p |
| |
| ret |
| |
| |
| /** |
| * P-256 scalar multiplication with base point G |
| * |
| * returns R = d*G = d*(x_g, y_g) |
| * with R and G being valid P-256 curve points in affine coordinates, |
| * furthermore G being the curves base point, |
| * d being a 256 bit scalar |
| * |
| * Performs a scalar multiplication of a scalar with the base point G of curve |
| * P-256. |
| * This routine runs in constant time. |
| * |
| * @param[in] dmem[4]: dptr_rnd, pointer to location in dmem containing random |
| * number for blinding |
| * @param[in] dmem[20]: dptr_x, pointer to affine x-coordinate in dmem |
| * @param[in] dmem[22]: dptr_y, pointer to affine y-coordinate in dmem |
| * @param[in] dmem[28]: dptr_d, pointer to location in dmem containing |
| * scalar d |
| * |
| * Flags: When leaving this subroutine, flags of FG0 depend on an |
| * intermediate result and are not usable after return. |
| * FG1 is not modified in this subroutine. |
| * |
| * clobbered registers: x3, x8 to x23, w0 to w25 |
| * clobbered flag groups: FG0 |
| */ |
| p256_scalar_base_mult: |
| |
| addi x0, x0, 0 |
| addi x3, x0, 0 |
| bn.lid x3, 0(x0) |
| |
| /* setup pointers into dmem */ |
| lw x16, 0(x0) |
| lw x17, 4(x0) |
| lw x18, 8(x0) |
| lw x19, 12(x0) |
| lw x20, 16(x0) |
| lw x21, 20(x0) |
| lw x22, 24(x0) |
| lw x23, 28(x0) |
| |
| /* setup pointers into reg file */ |
| addi x8, x0, 0 |
| addi x9, x0, 1 |
| addi x10, x0, 24 |
| addi x11, x0, 11 |
| addi x12, x0, 8 |
| addi x13, x0, 9 |
| |
| /* setup more dmem pointers */ |
| lw x14, 24(x0) |
| lw x15, 28(x0) |
| |
| bn.lid x8, 0(x17) |
| |
| /* load base point G affine coordinates G = (w8, w9) <= (x_g, y_g) */ |
| jal x1, load_basepoint |
| |
| /* store affine base point coordinates in dmem |
| dmem[dptr_x] = w8; dmem[dptr_y] = w9 */ |
| bn.sid x12, 0(x21) |
| bn.sid x13, 0(x22) |
| |
| /* load scalar d from dmem w0 = dmem[dptr_d] */ |
| addi x0, x0, 0 |
| bn.lid x8, 0(x23) |
| |
| /* scalar multiplication with base point |
| R = (x_r, y_r) = (w11, w12) <= d*G = w0*(dmem[dptr_x], dmem[dptr_y]) */ |
| jal x1, scalar_mult_int |
| |
| /* store result (affine coordinates) in dmem |
| dmem[x21] = dmem[dptr_x] <= x_r = w11 |
| dmem[x22] = dmem[dptr_y] <= y_r = w12 */ |
| bn.sid x11++, 0(x21) |
| bn.sid x11++, 0(x22) |
| |
| ret |
| |
| |
| /** |
| * Variable time modular multiplicative inverse computation |
| * |
| * Returns c <= a^(-1) mod m |
| * with a being a bigint of length 256 bit with a < m |
| * m being the modulus with a length of 256 bit |
| * c being a 256-bit result |
| * |
| * This routine implements the computation of the modular multiplicative |
| * inverse based on the binary GCD or Stein's algorithm. |
| * The implemented variant is based on the |
| * "right-shift binary extended GCD" as it is described in section 3.1 of [1] |
| * (Algorithm 1). |
| * [1] https://doi.org/10.1155/ES/2006/32192 |
| * |
| * Note that this is a variable time implementation. I.e. this routine will |
| * show a data dependent timing and execution profile. Only use in situations |
| * where a full white-box environment is acceptable. |
| * |
| * Flags: When leaving this subroutine, flags of FG0 depend on an |
| * intermediate result and are not usable after return. |
| * FG1 is not modified in this subroutine. |
| * |
| * @param[in] w0: a, operand |
| * @param[in] MOD: m, modulus |
| * @param[in] w30: constant 1 |
| * @param[in] w31: all-zero |
| * @param[out] w1: result c |
| * |
| * clobbered registers: x2, w2, w3, w4, w7 |
| * clobbered flag groups: FG0 |
| */ |
| mod_inv_var: |
| |
| /* w2 = r = 0 */ |
| bn.mov w2, w31 |
| |
| /* w3 = s = 1 */ |
| bn.mov w3, w30 |
| |
| /* w4 = u = MOD */ |
| bn.wsrr w4, 0 |
| bn.wsrr w7, 0 |
| |
| /* w5 = v = w0 */ |
| bn.mov w5, w0 |
| |
| ebgcd_loop: |
| /* test if u is odd */ |
| bn.or w4, w4, w4 |
| csrrs x2, 1984, x0 |
| andi x2, x2, 4 |
| bne x2, x0, ebgcd_u_odd |
| |
| /* u is even: */ |
| /* w4 = u <= u/2 = w4 >> 1 */ |
| bn.rshi w4, w31, w4 >> 1 |
| |
| /* test if r is odd */ |
| bn.or w2, w2, w2 |
| csrrs x2, 1984, x0 |
| andi x2, x2, 4 |
| bne x2, x0, ebgcd_r_odd |
| |
| /* r is even: */ |
| /* w2 = r <= r/2 = w2 >> 1 */ |
| bn.rshi w2, w31, w2 >> 1 |
| jal x0, ebgcd_loop |
| |
| ebgcd_r_odd: |
| /* w2 = r <= (r + m)/2 = (w2 + w7) >> 1 */ |
| bn.add w2, w7, w2 |
| bn.addc w6, w31, w31 |
| bn.rshi w2, w6, w2 >> 1 |
| jal x0, ebgcd_loop |
| |
| ebgcd_u_odd: |
| /* test if v is odd */ |
| bn.or w5, w5, w5 |
| csrrs x2, 1984, x0 |
| andi x2, x2, 4 |
| bne x2, x0, ebgcd_uv_odd |
| |
| /* v is even: */ |
| /* w5 = v <= v/2 = w5 >> 1 */ |
| bn.rshi w5, w31, w5 >> 1 |
| |
| /* test if s is odd */ |
| bn.or w3, w3, w3 |
| csrrs x2, 1984, x0 |
| andi x2, x2, 4 |
| bne x2, x0, ebgcd_s_odd |
| |
| /* s is even: */ |
| /* w3 = s <= s/2 = w3 >> 1 */ |
| bn.rshi w3, w31, w3 >> 1 |
| jal x0, ebgcd_loop |
| |
| ebgcd_s_odd: |
| /* w3 = s <= (s + m)/2 = (w3 + w7) >> 1 */ |
| bn.add w3, w7, w3 |
| bn.addc w6, w31, w31 |
| bn.rshi w3, w6, w3 >> 1 |
| jal x0, ebgcd_loop |
| |
| ebgcd_uv_odd: |
| /* test if v >= u */ |
| bn.cmp w5, w4 |
| csrrs x2, 1984, x0 |
| andi x2, x2, 1 |
| beq x2, x0, ebgcd_v_gte_u |
| |
| /* u > v: */ |
| /* w2 = r <= r - s = w2 - w3; if (r < 0): r <= r + m */ |
| bn.subm w2, w2, w3 |
| |
| /* w4 = u <= u - v = w4 - w5 */ |
| bn.sub w4, w4, w5 |
| jal x0, ebgcd_loop |
| |
| ebgcd_v_gte_u: |
| /* w3 = s <= s - r = w3 - w2; if (s < 0) s <= s + m */ |
| bn.subm w3, w3, w2 |
| |
| /* w5 = v <= v - u = w5 - w4 */ |
| bn.sub w5, w5, w4 |
| |
| /* if v > 0 go back to start of loop */ |
| csrrs x2, 1984, x0 |
| andi x2, x2, 8 |
| beq x2, x0, ebgcd_loop |
| |
| /* v <= 0: */ |
| /* if (r > m): w1 = a = r - m = w2 - MOD else: w1 = a = r = w2 */ |
| bn.addm w1, w2, w31 |
| |
| ret |
| |
| |
| /** |
| * P-256 ECDSA signature verification |
| * |
| * returns the affine x-coordinate of |
| * (x1, y1) = u1*G + u2*Q |
| * with u1 = z*s^-1 mod n and u2 = r*s^-1 mod n |
| * with G being the curve's base point, |
| * z being the message |
| * r, s being the signature |
| * Q being the public key. |
| * |
| * The routine computes the x1 coordinate and places it in dmem. x1 will be |
| * reduced (mod n), however, the final comparison has to be performed on the |
| * host side. The signature is valid if x1 == r. |
| * This routine runs in variable time. |
| * |
| * @param[in] dmem[4]: dptr_x1, pointer to dmem location where the reduced |
| * affine x1-coordinate will be stored |
| * @param[in] dmem[8]: dptr_msg, pointer to the message to be verified in dmem |
| * @param[in] dmem[12]: dptr_r, pointer to s of signature in dmem |
| * @param[in] dmem[16]: dptr_s, pointer to r of signature in dmem |
| * @param[in] dmem[20]: dptr_x, pointer to x-coordinate of public key in dmem |
| * @param[in] dmem[20]: dptr_y, pointer to y-coordinate of public key in dmem |
| * |
| * Flags: When leaving this subroutine, flags of FG0 depend on an |
| * intermediate result and are not usable after return. |
| * FG1 is not modified in this subroutine. |
| * |
| * clobbered registers: x2, x3, x8 to x23, w0 to w25 |
| * clobbered flag groups: FG0 |
| */ |
| p256_verify: |
| |
| addi x3, x0, 6 |
| bn.lid x3, 0(x0) |
| |
| lw x16, 0(x0) |
| |
| /* load dmem pointer to x1 (result) from dmem: x17 <= dptr_x1 = dmem[4] */ |
| lw x17, 4(x0) |
| |
| /* load dmem pointer to message from dmem: x18 <= dptr_msg = dmem[8] */ |
| lw x18, 8(x0) |
| |
| /* load dmem pointer to signature r from dmem: x19 <= dptr_r = dmem[12] */ |
| lw x19, 12(x0) |
| |
| /* load dmem pointer to signature s from dmem, x20 <= dptr_s = dmem[16] */ |
| lw x20, 16(x0) |
| |
| /* load dmem pointer to affine x-coordinate of public key from dmem: |
| x21 <= dptr_x = dmem[20] */ |
| lw x21, 20(x0) |
| |
| /* load dmem pointer to affine y-coordinate of public key from dmem: |
| x22 <= dptr_y = dmem[24] */ |
| lw x22, 24(x0) |
| |
| lw x23, 28(x0) |
| |
| /* setup pointers to WREGs */ |
| addi x8, x0, 11 |
| |
| /* load dmem pointer to x1 (result) from dmem: x17 <= dptr_x1 = dmem[4] */ |
| lw x9, 4(x0) |
| |
| /* setup pointers to WREGs */ |
| addi x10, x0, 24 |
| addi x11, x0, 24 |
| addi x12, x0, 0 |
| addi x13, x0, 8 |
| addi x14, x0, 9 |
| addi x15, x0, 12 |
| |
| /* load r of signature from dmem: w24 = r = dmem[dptr_r] */ |
| bn.lid x11, 0(x19) |
| |
| bn.mov w24, w6 |
| bn.not w24, w24 |
| |
| /* setup modulus n (curve order) and Barrett constant */ |
| jal x1, setup_barrett_n |
| |
| bn.cmp w6, w31 |
| csrrs x2, 1984, x0 |
| andi x2, x2, 8 |
| bne x2, x0, fail |
| |
| bn.cmp w6, w29 |
| csrrs x2, 1984, x0 |
| andi x2, x2, 1 |
| beq x2, x0, fail |
| |
| /* load s of signature from dmem: w0 = s = dmem[dptr_s] */ |
| bn.lid x12, 0(x20) |
| |
| /* goto 'fail' if w0 == w31 <=> s == 0 */ |
| bn.cmp w0, w31 |
| csrrs x2, 1984, x0 |
| andi x2, x2, 8 |
| bne x2, x0, fail |
| |
| /* goto 'fail' if w0 >= w29 <=> s >= n */ |
| bn.cmp w0, w29 |
| csrrs x2, 1984, x0 |
| andi x2, x2, 1 |
| beq x2, x0, fail |
| |
| /* w1 = s^-1 mod n */ |
| jal x1, mod_inv_var |
| |
| /* load r of signature from dmem: w24 = r = dmem[dptr_r] */ |
| bn.lid x11, 0(x19) |
| |
| /* w25 = s^-1 = w1 */ |
| bn.mov w25, w1 |
| |
| /* u2 = w0 = w19 <= w24*w25 = r*s^-1 mod n */ |
| jal x1, mod_mul_256x256 |
| bn.mov w0, w19 |
| |
| /* load message, w24 = msg = dmem[dptr_msg] */ |
| bn.lid x10, 0(x18) |
| |
| /* u1 = w1 = w19 <= w24*w25 = w24*w1 = msg*s^-1 mod n */ |
| bn.mov w25, w1 |
| jal x1, mod_mul_256x256 |
| bn.mov w1, w19 |
| |
| /* setup modulus p and Barrett constant */ |
| jal x1, setup_barrett_p |
| |
| /* load public key Q from dmem and use in projective form (set z to 1) |
| Q = (w11, w12, w13) = (dmem[dptr_x], dmem[dptr_y], 1) */ |
| bn.lid x8, 0(x21) |
| bn.lid x15, 0(x22) |
| bn.mov w13, w30 |
| |
| /* load base point G and use in projective form (set z to 1) |
| G = (w8, w9, w10) = (x_g, y_g, 1) */ |
| jal x1, load_basepoint |
| bn.mov w10, w30 |
| |
| /* The rest of the routine implements a variable time double-and-add |
| algorithm. For the signature verification we need to compute the point |
| C = (x1, y1) = u_1*G + u_2*Q. This can be done in a single |
| double-and-add routine by using Shamir's Trick. */ |
| |
| /* G+Q = (w3, w4, w5) = (w11, w12, w13) = (w8, w9, w10) + (w11, w12, w13) */ |
| jal x1, proj_add |
| bn.mov w3, w11 |
| bn.mov w4, w12 |
| bn.mov w5, w13 |
| |
| /* w2 = u_2 & u_0 = w0 & w1*/ |
| bn.and w2, w0, w1 |
| |
| /* init double and add algorithm with (0, 1, 0) */ |
| bn.mov w11, w31 |
| bn.mov w12, w30 |
| bn.mov w13, w31 |
| |
| /* main loop with dicreasing index i (i=255 downto 0) */ |
| loopi 256, 30 |
| |
| /* always double: C <= 2*C */ |
| bn.mov w8, w11 |
| bn.mov w9, w12 |
| bn.mov w10, w13 |
| jal x1, proj_add |
| |
| /* if either u_1[i] == 0 or u_2[i] == 0 jump to 'no_both' */ |
| bn.add w2, w2, w2 |
| csrrs x2, 1984, x0 |
| andi x2, x2, 1 |
| beq x2, x0, no_both |
| |
| /* both bits at current index (u1[i] and u2[i]) are set: |
| do C <= C + (P + Q) and jump to end */ |
| bn.mov w8, w3 |
| bn.mov w9, w4 |
| bn.mov w10, w5 |
| jal x1, proj_add |
| jal x0, no_q |
| |
| /* either u1[i] or u2[i] is set, but not both */ |
| no_both: |
| |
| /* if u2[i] is not set jump to 'no_g' */ |
| bn.add w6, w0, w0 |
| csrrs x2, 1984, x0 |
| andi x2, x2, 1 |
| beq x2, x0, no_g |
| |
| /* u2[i] is set: do C <= C + Q */ |
| bn.lid x13, 0(x21) |
| bn.lid x14, 0(x22) |
| bn.mov w10, w30 |
| jal x1, proj_add |
| |
| no_g: |
| /* if u1[i] is not set jump to 'no_q' */ |
| bn.add w6, w1, w1 |
| csrrs x2, 1984, x0 |
| andi x2, x2, 1 |
| beq x2, x0, no_q |
| |
| /* u1[i] is set: do C <= C + G */ |
| jal x1, load_basepoint |
| bn.mov w10, w30 |
| jal x1, proj_add |
| |
| no_q: |
| /* left shift w0 and w1 to decrease index */ |
| bn.add w0, w0, w0 |
| bn.add w1, w1, w1 |
| |
| /* compute inverse of z-coordinate: w1 = z_c^-1 mod p */ |
| bn.mov w0, w13 |
| jal x1, mod_inv_var |
| |
| /* convert x-coordinate of C back to affine: x1 = x_c * z_c^-1 mod p */ |
| bn.mov w24, w1 |
| bn.mov w25, w11 |
| jal x1, mod_mul_256x256 |
| |
| /* final reduction: w24 = x1 <= x1 mod n */ |
| jal x1, setup_barrett_n |
| bn.subm w24, w19, w31 |
| |
| fail: |
| /* store affine x-coordinate in dmem: dmem[dptr_x1] = w24 = x1 */ |
| bn.sid x11, 0(x17) |
| |
| ret |
| |
| |
| /** |
| * Externally callable wrapper for P-256 scalar point multiplication |
| * |
| * returns R = k*P = k*(x_p, y_p, z_p) |
| * with R, P being valid P-256 curve points in projective form, |
| * k being a 256 bit scalar. |
| * |
| * Sets up context and calls internal scalar multiplication routine. |
| * This routine runs in constant time. |
| * |
| * @param[in] dmem[0]: dK, pointer to location in dmem containing scalar k |
| * @param[in] dmem[4]: dRnd, pointer to location in dmem containing random |
| * number for blinding |
| * @param[in] dmem[20]: dptr_x, pointer to affine x-coordinate in dmem |
| * @param[in] dmem[22]: dptr_y, pointer to affine y-coordinate in dmem |
| * |
| * Flags: When leaving this subroutine, the M, L and Z flags of FG0 depend on |
| * the computed affine y-coordinate. |
| * |
| * clobbered registers: x3, x8 to x23, w0 to w25 |
| * clobbered flag groups: FG0 |
| */ |
| p256_scalarmult: |
| |
| /* w0 = dmem[0] */ |
| addi x3, x0, 0 |
| bn.lid x3, 0(x0) |
| |
| /* setup pointers to dmem */ |
| /* x16 = dptr_k */ |
| lw x16, 0(x0) |
| |
| /* x17 = dptr_rnd */ |
| lw x17, 4(x0) |
| |
| lw x18, 8(x0) |
| lw x19, 12(x0) |
| lw x20, 16(x0) |
| |
| /* x21 = dptr_x */ |
| lw x21, 20(x0) |
| |
| /* x22 = dptr_y */ |
| lw x22, 24(x0) |
| |
| lw x23, 28(x0) |
| |
| /* setup pointers to WREGs */ |
| addi x8, x0, 0 |
| addi x9, x0, 1 |
| addi x10, x0, 24 |
| addi x11, x0, 11 |
| |
| /* setup pointers to dmem */ |
| lw x12, 16(x0) |
| lw x13, 20(x0) |
| lw x14, 24(x0) |
| lw x15, 28(x0) |
| |
| /* load scalar k |
| w0 = k = dmem[x16] = dmem[0] */ |
| bn.lid x8, 0(x16) |
| |
| /* call internal scalar multiplication routine |
| R = (x_a, y_a) = (w11, w12) <= k*P = w0*P */ |
| jal x1, scalar_mult_int |
| |
| /* store result (affine coordinates) in dmem |
| dmem[x21] = dmem[dptr_x] <= x_a = w11 |
| dmem[x22] = dmem[dptr_y] <= y_a = w12 */ |
| bn.sid x11++, 0(x21) |
| bn.sid x11++, 0(x22) |
| |
| ret |
