aws-crt 0.1.9 → 0.2.0

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/digest/digest.c

@@ -131,8 +131,16 @@ void EVP_MD_CTX_free(EVP_MD_CTX *ctx) {
 void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx) { EVP_MD_CTX_free(ctx); }
 
 int EVP_DigestFinalXOF(EVP_MD_CTX *ctx, uint8_t *out, size_t len) {
-  OPENSSL_PUT_ERROR(DIGEST, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-  return 0;
+  if (ctx->digest == NULL) {
+    return 0;
+  }
+  if ((EVP_MD_flags(ctx->digest) & EVP_MD_FLAG_XOF) == 0) {
+    OPENSSL_PUT_ERROR(DIGEST, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+  ctx->digest->finalXOF(ctx, out, len);
+  EVP_MD_CTX_cleanse(ctx);
+  return 1;
 }
 
 uint32_t EVP_MD_meth_get_flags(const EVP_MD *md) { return EVP_MD_flags(md); }
@@ -245,6 +253,10 @@ int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, uint8_t *md_out, unsigned int *size) {
   if (ctx->digest == NULL) {
     return 0;
   }
+  if (EVP_MD_flags(ctx->digest) & EVP_MD_FLAG_XOF) {
+    OPENSSL_PUT_ERROR(DIGEST, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
 
   assert(ctx->digest->md_size <= EVP_MAX_MD_SIZE);
   ctx->digest->final(ctx, md_out);
@@ -256,7 +268,6 @@ int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, uint8_t *md_out, unsigned int *size) {
 }
 
 int EVP_DigestFinal(EVP_MD_CTX *ctx, uint8_t *md, unsigned int *size) {
-  
   int ok = EVP_DigestFinal_ex(ctx, md, size);
   EVP_MD_CTX_cleanup(ctx);
   return ok;
@@ -267,11 +278,23 @@ int EVP_Digest(const void *data, size_t count, uint8_t *out_md,
   EVP_MD_CTX ctx;
   int ret;
 
+  if ((EVP_MD_flags(type) & EVP_MD_FLAG_XOF) && out_size == NULL) {
+    OPENSSL_PUT_ERROR(DIGEST, ERR_R_PASSED_NULL_PARAMETER);
+    return 0;
+  }
+
   EVP_MD_CTX_init(&ctx);
   ret = EVP_DigestInit_ex(&ctx, type, impl) &&
-        EVP_DigestUpdate(&ctx, data, count) &&
-        EVP_DigestFinal_ex(&ctx, out_md, out_size);
-  EVP_MD_CTX_cleanup(&ctx);
+        EVP_DigestUpdate(&ctx, data, count);
+  if (ret == 0) {
+      return 0;
+  }
+
+  if (EVP_MD_flags(type) & EVP_MD_FLAG_XOF) {
+    ret &= EVP_DigestFinalXOF(&ctx, out_md, *out_size);
+  } else {
+    ret &= EVP_DigestFinal(&ctx, out_md, out_size);
+  }
 
   return ret;
 }

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/digest/digests.c

@@ -95,6 +95,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_md4) {
   out->init = md4_init;
   out->update = md4_update;
   out->final = md4_final;
+  out->finalXOF = NULL;
   out->block_size = 64;
   out->ctx_size = sizeof(MD4_CTX);
 }
@@ -119,6 +120,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_md5) {
   out->init = md5_init;
   out->update = md5_update;
   out->final = md5_final;
+  out->finalXOF = NULL;
   out->block_size = 64;
   out->ctx_size = sizeof(MD5_CTX);
 }
@@ -143,6 +145,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_ripemd160) {
   out->init = ripemd160_init;
   out->update = ripemd160_update;
   out->final = ripemd160_final;
+  out->finalXOF = NULL;
   out->block_size = 64;
   out->ctx_size = sizeof(RIPEMD160_CTX);
 }
@@ -167,6 +170,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha1) {
   out->init = sha1_init;
   out->update = sha1_update;
   out->final = sha1_final;
+  out->finalXOF = NULL;
   out->block_size = 64;
   out->ctx_size = sizeof(SHA_CTX);
 }
@@ -191,6 +195,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha224) {
   out->init = sha224_init;
   out->update = sha224_update;
   out->final = sha224_final;
+  out->finalXOF = NULL;
   out->block_size = 64;
   out->ctx_size = sizeof(SHA256_CTX);
 }
@@ -215,6 +220,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha256) {
   out->init = sha256_init;
   out->update = sha256_update;
   out->final = sha256_final;
+  out->finalXOF = NULL;
   out->block_size = 64;
   out->ctx_size = sizeof(SHA256_CTX);
 }
@@ -239,6 +245,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha384) {
   out->init = sha384_init;
   out->update = sha384_update;
   out->final = sha384_final;
+  out->finalXOF = NULL;
   out->block_size = 128;
   out->ctx_size = sizeof(SHA512_CTX);
 }
@@ -263,6 +270,31 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha512) {
   out->init = sha512_init;
   out->update = sha512_update;
   out->final = sha512_final;
+  out->finalXOF = NULL;
+  out->block_size = 128;
+  out->ctx_size = sizeof(SHA512_CTX);
+}
+
+
+static void sha512_224_init(EVP_MD_CTX *ctx) {
+  CHECK(SHA512_224_Init(ctx->md_data));
+}
+
+static void sha512_224_update(EVP_MD_CTX *ctx, const void *data, size_t count) {
+  CHECK(SHA512_224_Update(ctx->md_data, data, count));
+}
+
+static void sha512_224_final(EVP_MD_CTX *ctx, uint8_t *md) {
+  CHECK(SHA512_224_Final(md, ctx->md_data));
+}
+
+DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha512_224) {
+  out->type = NID_sha512_224;
+  out->md_size = SHA512_224_DIGEST_LENGTH;
+  out->flags = 0;
+  out->init = sha512_224_init;
+  out->update = sha512_224_update;
+  out->final = sha512_224_final;
   out->block_size = 128;
   out->ctx_size = sizeof(SHA512_CTX);
 }
@@ -287,6 +319,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha512_256) {
   out->init = sha512_256_init;
   out->update = sha512_256_update;
   out->final = sha512_256_final;
+  out->finalXOF = NULL;
   out->block_size = 128;
   out->ctx_size = sizeof(SHA512_CTX);
 }
@@ -311,6 +344,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha3_224) {
   out->init = sha3_224_init;
   out->update = sha3_224_update;
   out->final = sha3_224_final;
+  out->finalXOF = NULL;
   out->block_size = SHA3_BLOCKSIZE(SHA3_224_DIGEST_BITLENGTH);
   out->ctx_size = sizeof(KECCAK1600_CTX);
 }
@@ -335,6 +369,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha3_256) {
   out->init = sha3_256_init;
   out->update = sha3_256_update;
   out->final = sha3_256_final;
+  out->finalXOF = NULL;
   out->block_size = SHA3_BLOCKSIZE(SHA3_256_DIGEST_BITLENGTH);
   out->ctx_size = sizeof(KECCAK1600_CTX);
 }
@@ -359,6 +394,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha3_384) {
   out->init = sha3_384_init;
   out->update = sha3_384_update;
   out->final = sha3_384_final;
+  out->finalXOF = NULL;
   out->block_size = SHA3_BLOCKSIZE(SHA3_384_DIGEST_BITLENGTH);
   out->ctx_size = sizeof(KECCAK1600_CTX);
 }
@@ -383,10 +419,62 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha3_512) {
   out->init = sha3_512_init;
   out->update = sha3_512_update;
   out->final = sha3_512_final;
+  out->finalXOF = NULL;
   out->block_size = SHA3_BLOCKSIZE(SHA3_512_DIGEST_BITLENGTH);
   out->ctx_size = sizeof(KECCAK1600_CTX);
 }
 
+
+static void shake128_init(EVP_MD_CTX *ctx) {
+  CHECK(SHAKE_Init(ctx->md_data, SHAKE128_BLOCKSIZE));
+}
+
+static void shake128_update(EVP_MD_CTX *ctx, const void *data, size_t count) {
+  CHECK(SHA3_Update(ctx->md_data, data, count));
+}
+
+static void shake128_final(EVP_MD_CTX *ctx, uint8_t *md, size_t len) {
+  CHECK(SHAKE_Final(md, ctx->md_data, len));
+}
+
+DEFINE_METHOD_FUNCTION(EVP_MD, EVP_shake128) {
+  out->type = NID_shake128;
+  out->md_size = 0;
+  out->flags = EVP_MD_FLAG_XOF;
+  out->init = shake128_init;
+  out->update = shake128_update;
+  out->final = NULL;
+  out->finalXOF = shake128_final;
+  out->block_size = SHAKE128_BLOCKSIZE;
+  out->ctx_size = sizeof(KECCAK1600_CTX);
+}
+
+
+static void shake256_init(EVP_MD_CTX *ctx) {
+  CHECK(SHAKE_Init(ctx->md_data, SHAKE256_BLOCKSIZE));
+}
+
+static void shake256_update(EVP_MD_CTX *ctx, const void *data, size_t count) {
+  CHECK(SHA3_Update(ctx->md_data, data, count));
+}
+
+static void shake256_finalXOF(EVP_MD_CTX *ctx, uint8_t *md, size_t len) {
+  CHECK(SHAKE_Final(md, ctx->md_data, len));
+}
+
+DEFINE_METHOD_FUNCTION(EVP_MD, EVP_shake256) {
+  out->type = NID_shake256;
+  out->md_size = 0;
+  out->flags = EVP_MD_FLAG_XOF;
+  out->init = shake256_init;
+  out->update = shake256_update;
+  out->final = NULL;
+  out->finalXOF = shake256_finalXOF;
+  out->block_size = SHAKE256_BLOCKSIZE;
+  out->ctx_size = sizeof(KECCAK1600_CTX);
+}
+
+
 typedef struct {
   MD5_CTX md5;
   SHA_CTX sha1;
@@ -417,6 +505,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_md5_sha1) {
   out->init = md5_sha1_init;
   out->update = md5_sha1_update;
   out->final = md5_sha1_final;
+  out->finalXOF = NULL;
   out->block_size = 64;
   out->ctx_size = sizeof(MD5_SHA1_CTX);
 }

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/digest/internal.h

@@ -90,6 +90,10 @@ struct env_md_st {
 
   // ctx_size contains the size, in bytes, of the state of the hash function.
   unsigned ctx_size;
+
+  // finalXOF completes the hash and writes |len| bytes of digest extended output
+  // to |out|.
+  void (*finalXOF)(EVP_MD_CTX *ctx, uint8_t *out, size_t len);
 };
 
 // evp_md_pctx_ops contains function pointers to allow the |pctx| member of

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/ec.c

@@ -249,7 +249,7 @@ DEFINE_METHOD_FUNCTION(struct built_in_curves, OPENSSL_built_in_curves) {
   out->curves[0].oid = kOIDP521;
   out->curves[0].oid_len = sizeof(kOIDP521);
   out->curves[0].comment = "NIST P-521";
-  out->curves[0].param_len = 66;
+  out->curves[0].param_len = EC_P521R1_FIELD_ELEM_BYTES;
   out->curves[0].params = kP521Params;
   out->curves[0].method =
 #if !defined(OPENSSL_SMALL)
@@ -264,7 +264,7 @@ DEFINE_METHOD_FUNCTION(struct built_in_curves, OPENSSL_built_in_curves) {
   out->curves[1].oid = kOIDP384;
   out->curves[1].oid_len = sizeof(kOIDP384);
   out->curves[1].comment = "NIST P-384";
-  out->curves[1].param_len = 48;
+  out->curves[1].param_len = EC_P384R1_FIELD_ELEM_BYTES;
   out->curves[1].params = kP384Params;
   out->curves[1].method =
 #if !defined(OPENSSL_SMALL)
@@ -280,7 +280,7 @@ DEFINE_METHOD_FUNCTION(struct built_in_curves, OPENSSL_built_in_curves) {
   out->curves[2].oid = kOIDP256;
   out->curves[2].oid_len = sizeof(kOIDP256);
   out->curves[2].comment = "NIST P-256";
-  out->curves[2].param_len = 32;
+  out->curves[2].param_len = EC_P256R1_FIELD_ELEM_BYTES;
   out->curves[2].params = kP256Params;
   out->curves[2].method =
 #if !defined(OPENSSL_NO_ASM) && \
@@ -297,7 +297,7 @@ DEFINE_METHOD_FUNCTION(struct built_in_curves, OPENSSL_built_in_curves) {
   out->curves[3].oid = kOIDP224;
   out->curves[3].oid_len = sizeof(kOIDP224);
   out->curves[3].comment = "NIST P-224";
-  out->curves[3].param_len = 28;
+  out->curves[3].param_len = EC_P224R1_FIELD_ELEM_BYTES;
   out->curves[3].params = kP224Params;
   out->curves[3].method =
 #if defined(BORINGSSL_HAS_UINT128) && !defined(OPENSSL_SMALL)
@@ -312,7 +312,7 @@ DEFINE_METHOD_FUNCTION(struct built_in_curves, OPENSSL_built_in_curves) {
   out->curves[4].oid = kOIDP256K1;
   out->curves[4].oid_len = sizeof(kOIDP256K1);
   out->curves[4].comment = "SEC/ANSI P-256 K1";
-  out->curves[4].param_len = 32;
+  out->curves[4].param_len = EC_P256K1_FIELD_ELEM_BYTES;
   out->curves[4].params = kP256K1Params;
   out->curves[4].method = EC_GFp_mont_method();
 }
@@ -338,7 +338,6 @@ EC_GROUP *ec_group_new(const EC_METHOD *meth) {
 
   ret->references = 1;
   ret->meth = meth;
-  BN_init(&ret->order);
 
   if (!meth->group_init(ret)) {
     OPENSSL_free(ret);
@@ -352,30 +351,13 @@ static int ec_group_set_generator(EC_GROUP *group, const EC_AFFINE *generator,
                                   const BIGNUM *order) {
   assert(group->generator == NULL);
 
-  if (!BN_copy(&group->order, order)) {
-    return 0;
-  }
-  // Store the order in minimal form, so it can be used with |BN_ULONG| arrays.
-  bn_set_minimal_width(&group->order);
-
-  BN_MONT_CTX_free(group->order_mont);
-  group->order_mont = BN_MONT_CTX_new_for_modulus(&group->order, NULL);
-  if (group->order_mont == NULL) {
+  BN_MONT_CTX_free(group->order);
+  group->order = BN_MONT_CTX_new_for_modulus(order, NULL);
+  if (group->order == NULL) {
     return 0;
   }
 
   group->field_greater_than_order = BN_cmp(&group->field, order) > 0;
-  if (group->field_greater_than_order) {
-    BIGNUM tmp;
-    BN_init(&tmp);
-    int ok =
-        BN_sub(&tmp, &group->field, order) &&
-        bn_copy_words(group->field_minus_order.words, group->field.width, &tmp);
-    BN_free(&tmp);
-    if (!ok) {
-      return 0;
-    }
-  }
 
   group->generator = EC_POINT_new(group);
   if (group->generator == NULL) {
@@ -609,8 +591,7 @@ void EC_GROUP_free(EC_GROUP *group) {
   }
 
   ec_point_free(group->generator, 0 /* don't free group */);
-  BN_free(&group->order);
-  BN_MONT_CTX_free(group->order_mont);
+  BN_MONT_CTX_free(group->order);
 
   OPENSSL_free(group);
 }
@@ -649,7 +630,7 @@ int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ignored) {
   return a->meth != b->meth ||
          a->generator == NULL ||
          b->generator == NULL ||
-         BN_cmp(&a->order, &b->order) != 0 ||
+         BN_cmp(&a->order->N, &b->order->N) != 0 ||
          BN_cmp(&a->field, &b->field) != 0 ||
          !ec_felem_equal(a, &a->a, &b->a) ||
          !ec_felem_equal(a, &a->b, &b->b) ||
@@ -661,8 +642,8 @@ const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group) {
 }
 
 const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group) {
-  assert(!BN_is_zero(&group->order));
-  return &group->order;
+  assert(group->order != NULL);
+  return &group->order->N;
 }
 
 int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx) {
@@ -673,7 +654,7 @@ int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx) {
 }
 
 int EC_GROUP_order_bits(const EC_GROUP *group) {
-  return BN_num_bits(&group->order);
+  return BN_num_bits(&group->order->N);
 }
 
 int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor,
@@ -979,11 +960,10 @@ static int arbitrary_bignum_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
   ERR_clear_error();
 
   // This is an unusual input, so we do not guarantee constant-time processing.
-  const BIGNUM *order = &group->order;
   BN_CTX_start(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
   int ok = tmp != NULL &&
-           BN_nnmod(tmp, in, order, ctx) &&
+           BN_nnmod(tmp, in, EC_GROUP_get0_order(group), ctx) &&
            ec_bignum_to_scalar(group, out, tmp);
   BN_CTX_end(ctx);
   return ok;
@@ -1122,8 +1102,11 @@ int ec_point_mul_scalar_base(const EC_GROUP *group, EC_JACOBIAN *r,
   group->meth->mul_base(group, r, scalar);
 
   // Check the result is on the curve to defend against fault attacks or bugs.
-  // This has negligible cost compared to the multiplication.
-  if (!ec_GFp_simple_is_on_curve(group, r)) {
+  // This has negligible cost compared to the multiplication. This can only
+  // happen on bug or CPU fault, so it is okay to leak this information (if the
+  // computed point is on the curve or not). The alternative would be to
+  // proceed with bad data.
+  if (!constant_time_declassify_int(ec_GFp_simple_is_on_curve(group, r))) {
     OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
     return 0;
   }

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/ec_key.c

@@ -93,8 +93,8 @@ static EC_WRAPPED_SCALAR *ec_wrapped_scalar_new(const EC_GROUP *group) {
 
   OPENSSL_memset(wrapped, 0, sizeof(EC_WRAPPED_SCALAR));
   wrapped->bignum.d = wrapped->scalar.words;
-  wrapped->bignum.width = group->order.width;
-  wrapped->bignum.dmax = group->order.width;
+  wrapped->bignum.width = group->order->N.width;
+  wrapped->bignum.dmax = group->order->N.width;
   wrapped->bignum.flags = BN_FLG_STATIC_DATA;
   return wrapped;
 }
@@ -486,7 +486,7 @@ int EC_KEY_generate_key(EC_KEY *key) {
   }
 
   // Check that the group order is FIPS compliant (FIPS 186-4 B.4.2).
-  if (BN_num_bits(EC_GROUP_get0_order(key->group)) < 160) {
+  if (EC_GROUP_order_bits(key->group) < 160) {
     OPENSSL_PUT_ERROR(EC, EC_R_INVALID_GROUP_ORDER);
     return 0;
   }

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/ec_montgomery.c

@@ -177,7 +177,8 @@ void ec_GFp_mont_felem_exp(const EC_GROUP *group, EC_FELEM *out,
 static int ec_GFp_mont_point_get_affine_coordinates(const EC_GROUP *group,
                                                     const EC_JACOBIAN *point,
                                                     EC_FELEM *x, EC_FELEM *y) {
-  if (ec_GFp_simple_is_at_infinity(group, point)) {
+  if (constant_time_declassify_int(
+          ec_GFp_simple_is_at_infinity(group, point))) {
     OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY);
     return 0;
   }
@@ -317,7 +318,7 @@ void ec_GFp_mont_add(const EC_GROUP *group, EC_JACOBIAN *out,
 
   // This case will never occur in the constant-time |ec_GFp_mont_mul|.
   BN_ULONG is_nontrivial_double = ~xneq & ~yneq & z1nz & z2nz;
-  if (is_nontrivial_double) {
+  if (constant_time_declassify_w(is_nontrivial_double)) {
     ec_GFp_mont_dbl(group, out, a);
     return;
   }
@@ -456,7 +457,7 @@ static int ec_GFp_mont_cmp_x_coordinate(const EC_GROUP *group,
                                         const EC_JACOBIAN *p,
                                         const EC_SCALAR *r) {
   if (!group->field_greater_than_order ||
-      group->field.width != group->order.width) {
+      group->field.width != group->order->N.width) {
     // Do not bother optimizing this case. p > order in all commonly-used
     // curves.
     return ec_GFp_simple_cmp_x_coordinate(group, p, r);
@@ -484,10 +485,11 @@ static int ec_GFp_mont_cmp_x_coordinate(const EC_GROUP *group,
   // Therefore there is a small possibility, less than 1/2^128, that group_order
   // < p.x < P. in that case we need not only to compare against |r| but also to
   // compare against r+group_order.
-  if (bn_less_than_words(r->words, group->field_minus_order.words,
-                         group->field.width)) {
-    // We can ignore the carry because: r + group_order < p < 2^256.
-    bn_add_words(r_Z2.words, r->words, group->order.d, group->field.width);
+  BN_ULONG carry =
+      bn_add_words(r_Z2.words, r->words, group->order->N.d, group->field.width);
+  if (carry == 0 &&
+      bn_less_than_words(r_Z2.words, group->field.d, group->field.width)) {
+    // r + group_order < p, so compare (r + group_order) * Z^2 against X.
     ec_GFp_mont_felem_mul(group, &r_Z2, &r_Z2, &Z2_mont);
     if (ec_felem_equal(group, &r_Z2, &X)) {
       return 1;

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/ec_test.cc

@@ -1267,8 +1267,8 @@ TEST(ECTest, SmallGroupOrder) {
   bssl::UniquePtr<EC_KEY> key2(EC_KEY_new());
   ASSERT_TRUE(key2);
   ASSERT_TRUE(EC_KEY_set_group(key2.get(), group.get()));
-  BN_clear(&key2.get()->group->order);
-  ASSERT_TRUE(BN_set_word(&key2.get()->group->order, 7));
+  BN_clear(&key2.get()->group->order->N);
+  ASSERT_TRUE(BN_set_word(&key2.get()->group->order->N, 7));
   ASSERT_FALSE(EC_KEY_generate_key_fips(key2.get()));
 }
 
@@ -1325,8 +1325,8 @@ TEST(ECDeathTest, SmallGroupOrderAndDie) {
   bssl::UniquePtr<EC_KEY> key2(EC_KEY_new());
   ASSERT_TRUE(key2);
   ASSERT_TRUE(EC_KEY_set_group(key2.get(), group.get()));
-  BN_clear(&key2.get()->group->order);
-  ASSERT_TRUE(BN_set_word(&key2.get()->group->order, 7));
+  BN_clear(&key2.get()->group->order->N);
+  ASSERT_TRUE(BN_set_word(&key2.get()->group->order->N, 7));
   ASSERT_DEATH_IF_SUPPORTED(EC_KEY_generate_key_fips(key2.get()), "");
 }
 
@@ -1886,7 +1886,6 @@ TEST(ECTest, LargeXCoordinateVectors) {
     bssl::UniquePtr<EC_POINT> pub_key(EC_POINT_new(group.get()));
     ASSERT_TRUE(pub_key);
 
-    size_t len = BN_num_bytes(&group.get()->field); // Modulus byte-length
     ASSERT_TRUE(EC_KEY_set_group(key.get(), group.get()));
 
     // |EC_POINT_set_affine_coordinates_GFp| sets given (x, y) according to the
@@ -1900,10 +1899,10 @@ TEST(ECTest, LargeXCoordinateVectors) {
     // Set the raw point directly with the BIGNUM coordinates.
     // Note that both are in little-endian byte order.
     OPENSSL_memcpy(key.get()->pub_key->raw.X.words,
-                   x.get()->d, len);
+                   x.get()->d, BN_BYTES * group->field.width);
     OPENSSL_memcpy(key.get()->pub_key->raw.Y.words,
-                   y.get()->d, len);
-    OPENSSL_memset(key.get()->pub_key->raw.Z.words, 0, len);
+                   y.get()->d, BN_BYTES * group->field.width);
+    OPENSSL_memset(key.get()->pub_key->raw.Z.words, 0, BN_BYTES * group->field.width);
     key.get()->pub_key->raw.Z.words[0] = 1;
 
     // |EC_KEY_check_fips| first calls the |EC_KEY_check_key| function that
@@ -1922,7 +1921,7 @@ TEST(ECTest, LargeXCoordinateVectors) {
 
     // Now replace the x-coordinate with the larger one, x+p.
     OPENSSL_memcpy(key.get()->pub_key->raw.X.words,
-                   xpp.get()->d, len);
+                   xpp.get()->d, BN_BYTES * group->field.width);
     // We expect |EC_KEY_check_fips| to always fail when given key with x > p.
     ASSERT_FALSE(EC_KEY_check_fips(key.get()));
 
@@ -2331,3 +2330,28 @@ TEST(ECTest, HashToScalar) {
   EXPECT_FALSE(ec_hash_to_scalar_p384_xmd_sha512_draft07(
       p224.get(), &scalar, kDST, sizeof(kDST), kMessage, sizeof(kMessage)));
 }
+
+TEST(ECTest, FelemBytes) {
+  std::tuple<int,int, int>  test_cases[2] = {
+          std::make_tuple(NID_secp384r1, P384_EC_FELEM_BYTES, P384_EC_FELEM_WORDS),
+          std::make_tuple(NID_secp521r1, P521_EC_FELEM_BYTES, P521_EC_FELEM_WORDS)
+  };
+
+  for(size_t i = 0; i < sizeof(test_cases)/sizeof(std::tuple<int,int,int>); i++) {
+    int nid = std::get<0>(test_cases[i]);
+    int expected_felem_bytes = std::get<1>(test_cases[i]);
+    int expected_felem_words = std::get<2>(test_cases[i]);
+
+    ASSERT_TRUE(expected_felem_bytes <= EC_MAX_BYTES);
+    ASSERT_TRUE(expected_felem_words <= EC_MAX_WORDS);
+    if( 0 == (expected_felem_bytes % BN_BYTES)) {
+      ASSERT_EQ(expected_felem_words, expected_felem_bytes / BN_BYTES);
+    } else {
+      ASSERT_EQ(expected_felem_words, 1 + (expected_felem_bytes / BN_BYTES));
+    }
+
+    bssl::UniquePtr<EC_GROUP> test_group(EC_GROUP_new_by_curve_name(nid));
+    ASSERT_TRUE(test_group);
+    ASSERT_EQ(test_group.get()->field.width, expected_felem_words);
+  }
+}

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/internal.h

@@ -100,6 +100,12 @@ int ECDH_compute_shared_secret(uint8_t *buf, size_t *buflen, const EC_POINT *pub
 #define EC_MAX_COMPRESSED (EC_MAX_BYTES + 1)
 #define EC_MAX_UNCOMPRESSED (2 * EC_MAX_BYTES + 1)
 
+#define EC_P521R1_FIELD_ELEM_BYTES 66
+#define EC_P384R1_FIELD_ELEM_BYTES 48
+#define EC_P256R1_FIELD_ELEM_BYTES 32
+#define EC_P224R1_FIELD_ELEM_BYTES 28
+#define EC_P256K1_FIELD_ELEM_BYTES 32
+
 OPENSSL_STATIC_ASSERT(EC_MAX_WORDS <= BN_SMALL_MAX_WORDS,
                       bn__small_functions_not_usable)
 
@@ -109,7 +115,7 @@ OPENSSL_STATIC_ASSERT(EC_MAX_WORDS <= BN_SMALL_MAX_WORDS,
 // An EC_SCALAR is an integer fully reduced modulo the order. Only the first
 // |order->width| words are used. An |EC_SCALAR| is specific to an |EC_GROUP|
 // and must not be mixed between groups.
-typedef union {
+typedef struct {
   // words is the representation of the scalar in little-endian order.
   BN_ULONG words[EC_MAX_WORDS];
 } EC_SCALAR;
@@ -196,6 +202,12 @@ void ec_scalar_select(const EC_GROUP *group, EC_SCALAR *out, BN_ULONG mask,
 
 // Field elements.
 
+#define P384_EC_FELEM_BYTES (48)
+#define P384_EC_FELEM_WORDS ((P384_EC_FELEM_BYTES + BN_BYTES - 1) / BN_BYTES)
+
+#define P521_EC_FELEM_BYTES (66)
+#define P521_EC_FELEM_WORDS ((P521_EC_FELEM_BYTES + BN_BYTES - 1) / BN_BYTES)
+
 // An EC_FELEM represents a field element. Only the first |field->width| words
 // are used. An |EC_FELEM| is specific to an |EC_GROUP| and must not be mixed
 // between groups. Additionally, the representation (whether or not elements are
@@ -429,7 +441,7 @@ void ec_precomp_select(const EC_GROUP *group, EC_PRECOMP *out, BN_ULONG mask,
 
 // ec_cmp_x_coordinate compares the x (affine) coordinate of |p|, mod the group
 // order, with |r|. It returns one if the values match and zero if |p| is the
-// point at infinity of the values do not match.
+// point at infinity of the values do not match. |p| is treated as public.
 int ec_cmp_x_coordinate(const EC_GROUP *group, const EC_JACOBIAN *p,
                         const EC_SCALAR *r);
 
@@ -491,7 +503,8 @@ struct ec_method_st {
 
   // point_get_affine_coordinates sets |*x| and |*y| to the affine coordinates
   // of |p|. Either |x| or |y| may be NULL to omit it. It returns one on success
-  // and zero if |p| is the point at infinity.
+  // and zero if |p| is the point at infinity. It leaks whether |p| was the
+  // point at infinity, but otherwise treats |p| as secret.
   int (*point_get_affine_coordinates)(const EC_GROUP *, const EC_JACOBIAN *p,
                                       EC_FELEM *x, EC_FELEM *y);
 
@@ -606,11 +619,10 @@ struct ec_group_st {
   // to avoid a reference cycle. Additionally, Z is guaranteed to be one, so X
   // and Y are suitable for use as an |EC_AFFINE|.
   EC_POINT *generator;
-  BIGNUM order;
 
   int curve_name;  // optional NID for named curve
 
-  BN_MONT_CTX *order_mont;  // data for ECDSA inverse
+  BN_MONT_CTX *order;
 
   // The following members are handled by the method functions,
   // even if they appear generic
@@ -627,13 +639,6 @@ struct ec_group_st {
   // otherwise.
   int field_greater_than_order;
 
-  // field_minus_order, if |field_greater_than_order| is true, is |field| minus
-  // |order| represented as an |EC_FELEM|. Otherwise, it is zero.
-  //
-  // Note: unlike |EC_FELEM|s used as intermediate values internal to the
-  // |EC_METHOD|, this value is not encoded in Montgomery form.
-  EC_FELEM field_minus_order;
-
   CRYPTO_refcount_t references;
 
   BN_MONT_CTX *mont;  // Montgomery structure.

data/aws-crt-ffi/crt/aws-lc/crypto/fipsmodule/ec/p224-64.c

@@ -178,10 +178,6 @@ static const p224_felem g_p224_pre_comp[2][16][3] = {
 
 // Helper functions to convert field elements to/from internal representation
 
-#if defined(AWSLC_FIPS)
-// Related to delocate issue with gcc-11
-__attribute__((noinline))
-#endif
 static void p224_generic_to_felem(p224_felem out, const EC_FELEM *in) {
   // |p224_felem|'s minimal representation uses four 56-bit words. |EC_FELEM|
   // uses four 64-bit words. (The top-most word only has 32 bits.)
@@ -738,8 +734,8 @@ static void p224_point_add(p224_felem x3, p224_felem y3, p224_felem z3,
   // tmp[i] < 2^116 + 2^64 + 8 < 2^117
   p224_felem_reduce(ftmp, tmp);
 
-  // the formulae are incorrect if the points are equal
-  // so we check for this and do doubling if this happens
+  // The formulae are incorrect if the points are equal, so we check for this
+  // and do doubling if this happens.
   x_equal = p224_felem_is_zero(ftmp);
   y_equal = p224_felem_is_zero(ftmp3);
   z1_is_zero = p224_felem_is_zero(z1);
@@ -747,7 +743,7 @@ static void p224_point_add(p224_felem x3, p224_felem y3, p224_felem z3,
   // In affine coordinates, (X_1, Y_1) == (X_2, Y_2)
   p224_limb is_nontrivial_double =
       x_equal & y_equal & (1 - z1_is_zero) & (1 - z2_is_zero);
-  if (is_nontrivial_double) {
+  if (constant_time_declassify_w(is_nontrivial_double)) {
     p224_point_double(x3, y3, z3, x1, y1, z1);
     return;
   }
@@ -866,7 +862,8 @@ static crypto_word_t p224_get_bit(const EC_SCALAR *in, size_t i) {
 static int ec_GFp_nistp224_point_get_affine_coordinates(
     const EC_GROUP *group, const EC_JACOBIAN *point, EC_FELEM *x,
     EC_FELEM *y) {
-  if (ec_GFp_simple_is_at_infinity(group, point)) {
+  if (constant_time_declassify_int(
+          ec_GFp_simple_is_at_infinity(group, point))) {
     OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY);
     return 0;
   }