File openssl-Add-constant-time-64.patch of Package openssl-1_1.29123
From 9018f3ce0f9fd57e65d8e7d43741f08797811766 Mon Sep 17 00:00:00 2001
From: Rich Salz <rsalz@openssl.org>
Date: Tue, 20 Jun 2017 15:21:21 -0400
Subject: [PATCH] Add constant-time 64
Standardize comments.
Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3727)
---
include/internal/constant_time_locl.h | 57 ++++++++++++++++++-----------
test/constant_time_test.c | 65 ++++++++++++++++++++++++++++++++++
2 files changed, 100 insertions(+), 22 deletions(-)
--- a/include/internal/constant_time_locl.h
+++ b/include/internal/constant_time_locl.h
@@ -20,17 +20,14 @@ extern "C" {
* The boolean methods return a bitmask of all ones (0xff...f) for true
* and 0 for false. This is useful for choosing a value based on the result
* of a conditional in constant time. For example,
- *
- * if (a < b) {
- * c = a;
- * } else {
- * c = b;
- * }
- *
+ * if (a < b) {
+ * c = a;
+ * } else {
+ * c = b;
+ * }
* can be written as
- *
- * unsigned int lt = constant_time_lt(a, b);
- * c = constant_time_select(lt, a, b);
+ * unsigned int lt = constant_time_lt(a, b);
+ * c = constant_time_select(lt, a, b);
*/
/*
@@ -40,35 +37,31 @@ extern "C" {
* replace this with something else on odd CPUs.
*/
static ossl_inline unsigned int constant_time_msb(unsigned int a);
+/* Convenience method for uint64_t. */
+static ossl_inline uint64_t constant_time_msb_64(uint64_t a);
-/*
- * Returns 0xff..f if a < b and 0 otherwise.
- */
+/* Returns 0xff..f if a < b and 0 otherwise. */
static ossl_inline unsigned int constant_time_lt(unsigned int a,
unsigned int b);
/* Convenience method for getting an 8-bit mask. */
static ossl_inline unsigned char constant_time_lt_8(unsigned int a,
unsigned int b);
+/* Convenience method for uint64_t. */
+static ossl_inline uint64_t constant_time_lt_64(uint64_t a, uint64_t b);
-/*
- * Returns 0xff..f if a >= b and 0 otherwise.
- */
+/* Returns 0xff..f if a >= b and 0 otherwise. */
static ossl_inline unsigned int constant_time_ge(unsigned int a,
unsigned int b);
/* Convenience method for getting an 8-bit mask. */
static ossl_inline unsigned char constant_time_ge_8(unsigned int a,
unsigned int b);
-/*
- * Returns 0xff..f if a == 0 and 0 otherwise.
- */
+/* Returns 0xff..f if a == 0 and 0 otherwise. */
static ossl_inline unsigned int constant_time_is_zero(unsigned int a);
/* Convenience method for getting an 8-bit mask. */
static ossl_inline unsigned char constant_time_is_zero_8(unsigned int a);
-/*
- * Returns 0xff..f if a == b and 0 otherwise.
- */
+/* Returns 0xff..f if a == b and 0 otherwise. */
static ossl_inline unsigned int constant_time_eq(unsigned int a,
unsigned int b);
/* Convenience method for getting an 8-bit mask. */
@@ -93,6 +86,9 @@ static ossl_inline unsigned int constant
static ossl_inline unsigned char constant_time_select_8(unsigned char mask,
unsigned char a,
unsigned char b);
+/* Convenience method for uint64_t. */
+static ossl_inline uint64_t constant_time_select_64(uint64_t mask, uint64_t a,
+ uint64_t b);
/* Convenience method for signed integers. */
static ossl_inline int constant_time_select_int(unsigned int mask, int a,
int b);
@@ -102,6 +98,11 @@ static ossl_inline unsigned int constant
return 0 - (a >> (sizeof(a) * 8 - 1));
}
+static ossl_inline uint64_t constant_time_msb_64(uint64_t a)
+{
+ return 0 - (a >> 63);
+}
+
static ossl_inline unsigned int constant_time_lt(unsigned int a,
unsigned int b)
{
@@ -114,6 +115,11 @@ static ossl_inline unsigned char constan
return (unsigned char)(constant_time_lt(a, b));
}
+static ossl_inline uint64_t constant_time_lt_64(uint64_t a, uint64_t b)
+{
+ return constant_time_msb_64(a ^ ((a ^ b) | ((a - b) ^ b)));
+}
+
static ossl_inline unsigned int constant_time_ge(unsigned int a,
unsigned int b)
{
@@ -178,6 +184,13 @@ static ossl_inline int constant_time_sel
return (int)(constant_time_select(mask, (unsigned)(a), (unsigned)(b)));
}
+static ossl_inline uint64_t constant_time_select_64(uint64_t mask, uint64_t a,
+ uint64_t b)
+{
+ return (mask & a) | (~mask & b);
+}
+
+
/*
* Expected usage pattern is to unconditionally set error and then
* wipe it if there was no actual error. |clear| is 1 or 0.
--- a/test/constant_time_test.c
+++ b/test/constant_time_test.c
@@ -18,6 +18,8 @@ static const unsigned int CONSTTIME_TRUE
static const unsigned int CONSTTIME_FALSE = 0;
static const unsigned char CONSTTIME_TRUE_8 = 0xff;
static const unsigned char CONSTTIME_FALSE_8 = 0;
+static uint64_t CONSTTIME_TRUE_64 = (uint64_t)(~(uint64_t)0);
+static uint64_t CONSTTIME_FALSE_64 = 0;
static int test_binary_op(unsigned int (*op) (unsigned int a, unsigned int b),
const char *op_name, unsigned int a, unsigned int b,
@@ -54,6 +56,22 @@ static int test_binary_op_8(unsigned
return 0;
}
+static int test_binary_op_64(uint64_t (*op)(uint64_t a, uint64_t b),
+ const char *op_name, uint64_t a, uint64_t b,
+ int is_true)
+{
+ uint64_t c = op(a, b);
+
+ if (is_true && c != CONSTTIME_TRUE_64) {
+ fprintf(stderr, "TRUE %s op failed a=%jx b=%jx\n", op_name, a, b);
+ return 0;
+ } else if (!is_true && c != CONSTTIME_FALSE_64) {
+ fprintf(stderr, "FALSE %s op failed a=%jx b=%jx\n", op_name, a, b);
+ return 0;
+ }
+ return 1;
+}
+
static int test_is_zero(unsigned int a)
{
unsigned int c = constant_time_is_zero(a);
@@ -122,6 +140,23 @@ static int test_select_8(unsigned char a
return 0;
}
+static int test_select_64(uint64_t a, uint64_t b)
+{
+ uint64_t selected = constant_time_select_64(CONSTTIME_TRUE_64, a, b);
+
+ if (selected != a) {
+ fprintf(stderr, "test_select_64 TRUE failed\n");
+ fprintf(stderr, "a=%jx b=%jx got %jx wanted a\n", a, b, selected);
+ return 0;
+ }
+ selected = constant_time_select_64(CONSTTIME_FALSE_64, a, b);
+ if (selected != b) {
+ fprintf(stderr, "a=%jx b=%jx got %jx wanted b\n", a, b, selected);
+ return 0;
+ }
+ return 1;
+}
+
static int test_select_int(int a, int b)
{
int selected = constant_time_select_int(CONSTTIME_TRUE, a, b);
@@ -187,6 +222,31 @@ static int signed_test_values[] = { 0, 1
INT_MIN + 1
};
+static uint64_t test_values_64[] = {
+ 0, 1, 1024, 12345, 32000, 32000000, 32000000001, UINT64_MAX / 2,
+ UINT64_MAX / 2 + 1, UINT64_MAX - 1, UINT64_MAX
+};
+
+static int test_64values(int i)
+{
+ uint64_t g = test_values_64[i];
+ int j, ret = 0;
+
+ for (j = i + 1; j < (int)OSSL_NELEM(test_values_64); j++) {
+ uint64_t h = test_values_64[j];
+
+ if (!test_binary_op_64(&constant_time_lt_64, "constant_time_lt_64",
+ g, h, g < h)
+ || !test_select_64(g, h)) {
+ fprintf(stderr, "Test failed for test_64values: "
+ "i=%d j=%d",
+ i, j);
+ ret = 1;
+ }
+ }
+ return ret;
+}
+
int main(int argc, char *argv[])
{
unsigned int a, b, i, j;
@@ -258,6 +318,11 @@ int main(int argc, char *argv[])
}
}
+ for (i = 0; i < (int)OSSL_NELEM(test_values_64); ++i) {
+ num_failed += test_64values(i);
+ num_all += 1;
+ }
+
if (!num_failed) {
fprintf(stdout, "success (ran %d tests)\n", num_all);
return EXIT_SUCCESS;
