visaljs 0.0.2 → 0.0.3

package/runtime/third_party/boringssl/crypto/fipsmodule/bn/random.cc.inc

@@ -0,0 +1,261 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/bn.h>
+
+#include <assert.h>
+#include <limits.h>
+#include <string.h>
+
+#include <openssl/err.h>
+
+#include "../../internal.h"
+#include "../bcm_interface.h"
+#include "../service_indicator/internal.h"
+#include "internal.h"
+
+
+using namespace bssl;
+
+int BN_rand(BIGNUM *rnd, int bits, int top, int bottom) {
+  if (rnd == nullptr) {
+    return 0;
+  }
+
+  if (top != BN_RAND_TOP_ANY && top != BN_RAND_TOP_ONE &&
+      top != BN_RAND_TOP_TWO) {
+    OPENSSL_PUT_ERROR(BN, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+
+  if (bottom != BN_RAND_BOTTOM_ANY && bottom != BN_RAND_BOTTOM_ODD) {
+    OPENSSL_PUT_ERROR(BN, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+
+  if (bits == 0) {
+    BN_zero(rnd);
+    return 1;
+  }
+
+  if (bits > INT_MAX - (BN_BITS2 - 1)) {
+    OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG);
+    return 0;
+  }
+
+  int words = (bits + BN_BITS2 - 1) / BN_BITS2;
+  int bit = (bits - 1) % BN_BITS2;
+  const BN_ULONG kOne = 1;
+  const BN_ULONG kThree = 3;
+  BN_ULONG mask = bit < BN_BITS2 - 1 ? (kOne << (bit + 1)) - 1 : BN_MASK2;
+  if (!bn_wexpand(rnd, words)) {
+    return 0;
+  }
+
+  FIPS_service_indicator_lock_state();
+  BCM_rand_bytes((uint8_t *)rnd->d, words * sizeof(BN_ULONG));
+  FIPS_service_indicator_unlock_state();
+
+  rnd->d[words - 1] &= mask;
+  if (top != BN_RAND_TOP_ANY) {
+    if (top == BN_RAND_TOP_TWO && bits > 1) {
+      if (bit == 0) {
+        rnd->d[words - 1] |= 1;
+        rnd->d[words - 2] |= kOne << (BN_BITS2 - 1);
+      } else {
+        rnd->d[words - 1] |= kThree << (bit - 1);
+      }
+    } else {
+      rnd->d[words - 1] |= kOne << bit;
+    }
+  }
+  if (bottom == BN_RAND_BOTTOM_ODD) {
+    rnd->d[0] |= 1;
+  }
+
+  rnd->neg = 0;
+  rnd->width = words;
+  return 1;
+}
+
+int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom) {
+  return BN_rand(rnd, bits, top, bottom);
+}
+
+// bn_less_than_word_mask returns a mask of all ones if the number represented
+// by `len` words at |a| is less than |b| and zero otherwise. It performs this
+// computation in time independent of the value of |a|. |b| is assumed public.
+static crypto_word_t bn_less_than_word_mask(const BN_ULONG *a, size_t len,
+                                            BN_ULONG b) {
+  if (b == 0) {
+    return CONSTTIME_FALSE_W;
+  }
+  if (len == 0) {
+    return CONSTTIME_TRUE_W;
+  }
+
+  // |a| < |b| iff a[1..len-1] are all zero and a[0] < b.
+  static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
+                "crypto_word_t is too small");
+  crypto_word_t mask = 0;
+  for (size_t i = 1; i < len; i++) {
+    mask |= a[i];
+  }
+  // `mask` is now zero iff a[1..len-1] are all zero.
+  mask = constant_time_is_zero_w(mask);
+  mask &= constant_time_lt_w(a[0], b);
+  return mask;
+}
+
+int bssl::bn_in_range_words(const BN_ULONG *a, BN_ULONG min_inclusive,
+                            const BN_ULONG *max_exclusive, size_t len) {
+  crypto_word_t mask = ~bn_less_than_word_mask(a, len, min_inclusive);
+  return mask & bn_less_than_words(a, max_exclusive, len);
+}
+
+static int bn_range_to_mask(size_t *out_words, BN_ULONG *out_mask,
+                            size_t min_inclusive, const BN_ULONG *max_exclusive,
+                            size_t len) {
+  // The magnitude of `max_exclusive` is assumed public.
+  size_t words = len;
+  while (words > 0 && max_exclusive[words - 1] == 0) {
+    words--;
+  }
+  if (words == 0 || (words == 1 && max_exclusive[0] <= min_inclusive)) {
+    OPENSSL_PUT_ERROR(BN, BN_R_INVALID_RANGE);
+    return 0;
+  }
+  BN_ULONG mask = max_exclusive[words - 1];
+  // This sets all bits in `mask` below the most significant bit.
+  mask |= mask >> 1;
+  mask |= mask >> 2;
+  mask |= mask >> 4;
+  mask |= mask >> 8;
+  mask |= mask >> 16;
+#if defined(OPENSSL_64_BIT)
+  mask |= mask >> 32;
+#endif
+
+  *out_words = words;
+  *out_mask = mask;
+  return 1;
+}
+
+int bssl::bn_rand_range_words(BN_ULONG *out, BN_ULONG min_inclusive,
+                              const BN_ULONG *max_exclusive, size_t len,
+                              const uint8_t additional_data[32]) {
+  // This function implements the equivalent of steps 1 through 4 of FIPS 186-5
+  // appendices A.2.2 and A.3.2, repeating the process on failure. When called
+  // in those contexts, `max_exclusive` is n and `min_inclusive` is one.
+
+  // Compute the bit length of `max_exclusive` (step 1), in terms of a number of
+  // `words` worth of entropy to fill and a mask of bits to clear in the top
+  // word.
+  size_t words;
+  BN_ULONG mask;
+  if (!bn_range_to_mask(&words, &mask, min_inclusive, max_exclusive, len)) {
+    return 0;
+  }
+
+  // Fill any unused words with zero.
+  OPENSSL_memset(out + words, 0, (len - words) * sizeof(BN_ULONG));
+
+  unsigned count = 100;
+  do {
+    if (!--count) {
+      OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_ITERATIONS);
+      return 0;
+    }
+
+    // Use `words` and `mask` together to obtain a string of N bits, where N is
+    // the bit length of `max_exclusive`.
+    FIPS_service_indicator_lock_state();
+    BCM_rand_bytes_with_additional_data(
+        (uint8_t *)out, words * sizeof(BN_ULONG), additional_data);
+    FIPS_service_indicator_unlock_state();
+    out[words - 1] &= mask;
+
+    // If out >= max_exclusive or out < min_inclusive, retry. The result of this
+    // comparison may be treated as public. It only reveals how many attempts
+    // were needed before we found a value in range. This is independent of the
+    // final secret output, and has a distribution that depends only on
+    // `min_inclusive` and `max_exclusive`, both of which are public.
+  } while (!constant_time_declassify_int(
+      bn_in_range_words(out, min_inclusive, max_exclusive, words)));
+  return 1;
+}
+
+int BN_rand_range_ex(BIGNUM *r, BN_ULONG min_inclusive,
+                     const BIGNUM *max_exclusive) {
+  static const uint8_t kDefaultAdditionalData[32] = {0};
+  if (!bn_wexpand(r, max_exclusive->width) ||
+      !bn_rand_range_words(r->d, min_inclusive, max_exclusive->d,
+                           max_exclusive->width, kDefaultAdditionalData)) {
+    return 0;
+  }
+
+  r->neg = 0;
+  r->width = max_exclusive->width;
+  return 1;
+}
+
+int bssl::bn_rand_secret_range(BIGNUM *r, int *out_is_uniform,
+                               BN_ULONG min_inclusive,
+                               const BIGNUM *max_exclusive) {
+  size_t words;
+  BN_ULONG mask;
+  if (!bn_range_to_mask(&words, &mask, min_inclusive, max_exclusive->d,
+                        max_exclusive->width) ||
+      !bn_wexpand(r, words)) {
+    return 0;
+  }
+
+  assert(words > 0);
+  assert(mask != 0);
+  // The range must be large enough for bit tricks to fix invalid values.
+  if (words == 1 && min_inclusive > mask >> 1) {
+    OPENSSL_PUT_ERROR(BN, BN_R_INVALID_RANGE);
+    return 0;
+  }
+
+  // Select a uniform random number with num_bits(max_exclusive) bits.
+  FIPS_service_indicator_lock_state();
+  BCM_rand_bytes((uint8_t *)r->d, words * sizeof(BN_ULONG));
+  FIPS_service_indicator_unlock_state();
+  r->d[words - 1] &= mask;
+
+  // Check, in constant-time, if the value is in range.
+  *out_is_uniform =
+      bn_in_range_words(r->d, min_inclusive, max_exclusive->d, words);
+  crypto_word_t in_range = *out_is_uniform;
+  in_range = 0 - in_range;
+
+  // If the value is not in range, force it to be in range.
+  r->d[0] |= constant_time_select_w(in_range, 0, min_inclusive);
+  r->d[words - 1] &= constant_time_select_w(in_range, BN_MASK2, mask >> 1);
+  declassify_assert(
+      bn_in_range_words(r->d, min_inclusive, max_exclusive->d, words));
+
+  r->neg = 0;
+  r->width = (int)words;
+  return 1;
+}
+
+int BN_rand_range(BIGNUM *r, const BIGNUM *range) {
+  return BN_rand_range_ex(r, 0, range);
+}
+
+int BN_pseudo_rand_range(BIGNUM *r, const BIGNUM *range) {
+  return BN_rand_range(r, range);
+}

package/runtime/third_party/boringssl/crypto/fipsmodule/bn/rsaz_exp.cc.inc

@@ -0,0 +1,144 @@
+// Copyright 2013-2016 The OpenSSL Project Authors. All Rights Reserved.
+// Copyright (c) 2012, Intel Corporation. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Originally written by Shay Gueron (1, 2), and Vlad Krasnov (1)
+// (1) Intel Corporation, Israel Development Center, Haifa, Israel
+// (2) University of Haifa, Israel
+
+#include "rsaz_exp.h"
+
+#if defined(RSAZ_ENABLED)
+
+#include <openssl/mem.h>
+
+#include <assert.h>
+
+#include "internal.h"
+#include "../../internal.h"
+
+
+using namespace bssl;
+
+// rsaz_one is 1 in RSAZ's representation.
+alignas(64) static const BN_ULONG rsaz_one[40] = {
+    1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+// rsaz_two80 is 2^80 in RSAZ's representation. Note RSAZ uses base 2^29, so this is
+// 2^(29*2 + 22) = 2^80, not 2^(64*2 + 22).
+alignas(64) static const BN_ULONG rsaz_two80[40] = {
+    0, 0, 1 << 22, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0,       0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+
+void bssl::RSAZ_1024_mod_exp_avx2(BN_ULONG result_norm[16],
+                                  const BN_ULONG base_norm[16],
+                                  const BN_ULONG exponent[16],
+                                  const BN_ULONG m_norm[16],
+                                  const BN_ULONG RR[16], BN_ULONG k0,
+                                  BN_ULONG storage[MOD_EXP_CTIME_STORAGE_LEN]) {
+  static_assert(MOD_EXP_CTIME_ALIGN % 64 == 0,
+                "MOD_EXP_CTIME_ALIGN is too small");
+  assert((uintptr_t)storage % 64 == 0);
+
+  BN_ULONG *a_inv, *m, *result, *table_s = storage + 40 * 3, *R2 = table_s;
+  // Note `R2` aliases `table_s`.
+  if (((((uintptr_t)storage & 4095) + 320) >> 12) != 0) {
+    result = storage;
+    a_inv = storage + 40;
+    m = storage + 40 * 2;  // should not cross page
+  } else {
+    m = storage;  // should not cross page
+    result = storage + 40;
+    a_inv = storage + 40 * 2;
+  }
+
+  rsaz_1024_norm2red_avx2(m, m_norm);
+  rsaz_1024_norm2red_avx2(a_inv, base_norm);
+  rsaz_1024_norm2red_avx2(R2, RR);
+
+  // Convert `R2` from the usual radix, giving R = 2^1024, to RSAZ's radix,
+  // giving R = 2^(36*29) = 2^1044.
+  rsaz_1024_mul_avx2(R2, R2, R2, m, k0);
+  // R2 = 2^2048 * 2^2048 / 2^1044 = 2^3052
+  rsaz_1024_mul_avx2(R2, R2, rsaz_two80, m, k0);
+  // R2 = 2^3052 * 2^80 / 2^1044 = 2^2088 = (2^1044)²
+
+  // table[0] = 1
+  // table[1] = a_inv¹
+  rsaz_1024_mul_avx2(result, R2, rsaz_one, m, k0);
+  rsaz_1024_mul_avx2(a_inv, a_inv, R2, m, k0);
+  rsaz_1024_scatter5_avx2(table_s, result, 0);
+  rsaz_1024_scatter5_avx2(table_s, a_inv, 1);
+  // table[2] = a_inv²
+  rsaz_1024_sqr_avx2(result, a_inv, m, k0, 1);
+  rsaz_1024_scatter5_avx2(table_s, result, 2);
+  // table[4] = a_inv⁴
+  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
+  rsaz_1024_scatter5_avx2(table_s, result, 4);
+  // table[8] = a_inv⁸
+  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
+  rsaz_1024_scatter5_avx2(table_s, result, 8);
+  // table[16] = a_inv^16
+  rsaz_1024_sqr_avx2(result, result, m, k0, 1);
+  rsaz_1024_scatter5_avx2(table_s, result, 16);
+  for (int i = 3; i < 32; i += 2) {
+    // table[i] = table[i-1] * a_inv = a_invⁱ
+    rsaz_1024_gather5_avx2(result, table_s, i - 1);
+    rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
+    rsaz_1024_scatter5_avx2(table_s, result, i);
+    for (int j = 2 * i; j < 32; j *= 2) {
+      // table[j] = table[j/2]^2 = a_inv^j
+      rsaz_1024_sqr_avx2(result, result, m, k0, 1);
+      rsaz_1024_scatter5_avx2(table_s, result, j);
+    }
+  }
+
+  // Load the first window.
+  const uint8_t *p_str = (const uint8_t *)exponent;
+  int wvalue = p_str[127] >> 3;
+  rsaz_1024_gather5_avx2(result, table_s, wvalue);
+
+  int index = 1014;
+  while (index > -1) {  // Loop for the remaining 127 windows.
+    rsaz_1024_sqr_avx2(result, result, m, k0, 5);
+
+    uint16_t wvalue_16;
+    memcpy(&wvalue_16, &p_str[index / 8], sizeof(wvalue_16));
+    wvalue = wvalue_16;
+    wvalue = (wvalue >> (index % 8)) & 31;
+    index -= 5;
+
+    rsaz_1024_gather5_avx2(a_inv, table_s, wvalue);  // Borrow `a_inv`.
+    rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
+  }
+
+  // Square four times.
+  rsaz_1024_sqr_avx2(result, result, m, k0, 4);
+
+  wvalue = p_str[0] & 15;
+
+  rsaz_1024_gather5_avx2(a_inv, table_s, wvalue);  // Borrow `a_inv`.
+  rsaz_1024_mul_avx2(result, result, a_inv, m, k0);
+
+  // Convert from Montgomery.
+  rsaz_1024_mul_avx2(result, result, rsaz_one, m, k0);
+
+  rsaz_1024_red2norm_avx2(result_norm, result);
+  BN_ULONG scratch[16];
+  bn_reduce_once_in_place(result_norm, /*carry=*/0, m_norm, scratch, 16);
+
+  OPENSSL_cleanse(storage, MOD_EXP_CTIME_STORAGE_LEN * sizeof(BN_ULONG));
+}
+
+#endif  // RSAZ_ENABLED

package/runtime/third_party/boringssl/crypto/fipsmodule/bn/rsaz_exp.h

@@ -0,0 +1,109 @@
+// Copyright 2013-2016 The OpenSSL Project Authors. All Rights Reserved.
+// Copyright (c) 2012, Intel Corporation. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Originally written by Shay Gueron (1, 2), and Vlad Krasnov (1)
+// (1) Intel Corporation, Israel Development Center, Haifa, Israel
+// (2) University of Haifa, Israel
+
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_BN_RSAZ_EXP_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_BN_RSAZ_EXP_H
+
+#include <openssl/bn.h>
+
+#include "../../internal.h"
+#include "internal.h"
+
+
+BSSL_NAMESPACE_BEGIN
+
+#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64)
+#define RSAZ_ENABLED
+
+// RSAZ_1024_mod_exp_avx2 sets `result` to `base_norm` raised to `exponent`
+// modulo `m_norm`. `base_norm` must be fully-reduced and `exponent` must have
+// the high bit set (it is 1024 bits wide). `RR` and `k0` must be `RR` and `n0`,
+// respectively, extracted from `m_norm`'s `BN_MONT_CTX`. `storage_words` is a
+// temporary buffer that must be aligned to `MOD_EXP_CTIME_ALIGN` bytes.
+void RSAZ_1024_mod_exp_avx2(BN_ULONG result[16], const BN_ULONG base_norm[16],
+                            const BN_ULONG exponent[16],
+                            const BN_ULONG m_norm[16], const BN_ULONG RR[16],
+                            BN_ULONG k0,
+                            BN_ULONG storage_words[MOD_EXP_CTIME_STORAGE_LEN]);
+
+inline int rsaz_avx2_capable() { return bssl::CRYPTO_is_AVX2_capable(); }
+
+inline int rsaz_avx2_preferred() {
+  if (bssl::CRYPTO_is_BMI1_capable() && bssl::CRYPTO_is_BMI2_capable() &&
+      bssl::CRYPTO_is_ADX_capable()) {
+    // If BMI1, BMI2, and ADX are available, x86_64-mont5.pl is faster. See the
+    // .Lmulx4x_enter and .Lpowerx5_enter branches.
+    return 0;
+  }
+  return bssl::CRYPTO_is_AVX2_capable();
+}
+
+
+// Assembly functions.
+
+// RSAZ represents 1024-bit integers using unsaturated 29-bit limbs stored in
+// 64-bit integers. This requires 36 limbs but padded up to 40.
+//
+// See crypto/bn/asm/rsaz-avx2.pl for further details.
+
+// rsaz_1024_norm2red_avx2 converts `norm` from `BIGNUM` to RSAZ representation
+// and writes the result to `red`.
+extern "C" void rsaz_1024_norm2red_avx2(BN_ULONG red[40],
+                                        const BN_ULONG norm[16]);
+
+// rsaz_1024_mul_avx2 computes `a` * `b` mod `n` and writes the result to `ret`.
+// Inputs and outputs are in Montgomery form, using RSAZ's representation. `k`
+// is -`n`^-1 mod 2^64 or `n0` from `BN_MONT_CTX`.
+extern "C" void rsaz_1024_mul_avx2(BN_ULONG ret[40], const BN_ULONG a[40],
+                                   const BN_ULONG b[40], const BN_ULONG n[40],
+                                   BN_ULONG k);
+
+// rsaz_1024_mul_avx2 computes `a`^(2*`count`) mod `n` and writes the result to
+// `ret`. Inputs and outputs are in Montgomery form, using RSAZ's
+// representation. `k` is -`n`^-1 mod 2^64 or `n0` from `BN_MONT_CTX`.
+extern "C" void rsaz_1024_sqr_avx2(BN_ULONG ret[40], const BN_ULONG a[40],
+                                   const BN_ULONG n[40], BN_ULONG k, int count);
+
+// rsaz_1024_scatter5_avx2 stores `val` at index `i` of `tbl`. `i` must be
+// positive and at most 31. It is treated as public. Note the table only uses 18
+// `BN_ULONG`s per entry instead of 40. It packs two 29-bit limbs into each
+// `BN_ULONG` and only stores 36 limbs rather than the padded 40.
+extern "C" void rsaz_1024_scatter5_avx2(BN_ULONG tbl[32 * 18],
+                                        const BN_ULONG val[40], int i);
+
+// rsaz_1024_gather5_avx2 loads index `i` of `tbl` and writes it to `val`. `i`
+// must be positive and at most 31. It is treated as secret. `tbl` must be
+// aligned to 32 bytes.
+extern "C" void rsaz_1024_gather5_avx2(BN_ULONG val[40],
+                                       const BN_ULONG tbl[32 * 18], int i);
+
+// rsaz_1024_red2norm_avx2 converts `red` from RSAZ to `BIGNUM` representation
+// and writes the result to `norm`. The result will be <= the modulus.
+//
+// WARNING: The result of this operation may not be fully reduced. `norm` may be
+// the modulus instead of zero. This function should be followed by a call to
+// `bn_reduce_once`.
+extern "C" void rsaz_1024_red2norm_avx2(BN_ULONG norm[16],
+                                        const BN_ULONG red[40]);
+
+#endif  // !OPENSSL_NO_ASM && OPENSSL_X86_64
+
+BSSL_NAMESPACE_END
+
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_BN_RSAZ_EXP_H