diff --git a/components/esp32/Makefile b/components/esp32/Makefile index 1d55d0ff6..95647c2eb 100644 --- a/components/esp32/Makefile +++ b/components/esp32/Makefile @@ -8,6 +8,8 @@ # -include $(PROJECT_PATH)/build/include/config/auto.conf +COMPONENT_SRCDIRS := . hwcrypto + LIBS := crypto core net80211 phy rtc pp wpa wps ifeq ($(CONFIG_MEMMAP_BT),y) diff --git a/components/esp32/hwcrypto/bignum.c b/components/esp32/hwcrypto/bignum.c deleted file mode 100644 index 96f12419e..000000000 --- a/components/esp32/hwcrypto/bignum.c +++ /dev/null @@ -1,2194 +0,0 @@ -/** - * \brief Multi-precision integer library, ESP32 hardware accelerated version - * Based on mbedTLS version. - * - * ESP32 hardware accelerated multi-precision integer functions - * based on mbedTLS implementation - * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved - * Additions Copyright (C) 2016, Espressif Systems (Shanghai) PTE Ltd - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -/* - * The following sources were referenced in the design of this Multi-precision - * Integer library: - * - * [1] Handbook of Applied Cryptography - 1997 - * Menezes, van Oorschot and Vanstone - * - * [2] Multi-Precision Math - * Tom St Denis - * https://github.com/libtom/libtommath/blob/develop/tommath.pdf - * - * [3] GNU Multi-Precision Arithmetic Library - * https://gmplib.org/manual/index.html - * - */ - -#include -#include -#include -#include "hwcrypto/bignum.h" -#include "rom/ets_sys.h" -#include "rom/bigint.h" - -/* Implementation that should never be optimized out by the compiler */ -//static void bzero( void *v, size_t n ) { -// volatile unsigned char *p = v; while( n-- ) *p++ = 0; -//} - -#define ciL (sizeof(esp_mpi_uint)) /* chars in limb */ -#define biL (ciL << 3) /* bits in limb */ -#define biH (ciL << 2) /* half limb size */ - -#define MPI_SIZE_T_MAX ( (size_t) -1 ) /* SIZE_T_MAX is not standard */ - -/* - * Convert between bits/chars and number of limbs - * Divide first in order to avoid potential overflows - */ -#define BITS_TO_LIMBS(i) ( (i) / biL + ( (i) % biL != 0 ) ) -#define CHARS_TO_LIMBS(i) ( (i) / ciL + ( (i) % ciL != 0 ) ) - -static _lock_t mpi_lock; - -void esp_mpi_acquire_hardware( void ) -{ - /* newlib locks lazy initialize on ESP-IDF */ - _lock_acquire(&mpi_lock); - ets_bigint_enable(); -} - -void esp_mpi_release_hardware( void ) -{ - ets_bigint_disable(); - _lock_release(&mpi_lock); -} - - -/* - * Initialize one MPI - */ -void esp_mpi_init( mpi *X ) -{ - if( X == NULL ) - return; - - X->s = 1; - X->n = 0; - X->p = NULL; -} - -/* - * Unallocate one MPI - */ -void esp_mpi_free( mpi *X ) -{ - if( X == NULL ) - return; - - if( X->p != NULL ) - { - bzero( X->p, X->n * ciL ); - free( X->p ); - } - - X->s = 1; - X->n = 0; - X->p = NULL; -} - -/* - * Enlarge to the specified number of limbs - */ -int esp_mpi_grow( mpi *X, size_t nblimbs ) -{ - esp_mpi_uint *p; - - if( nblimbs > MPI_MAX_LIMBS ) - return( ERR_MPI_ALLOC_FAILED ); - - if( X->n < nblimbs ) - { - if( ( p = calloc( nblimbs, ciL ) ) == NULL ) - return( ERR_MPI_ALLOC_FAILED ); - - if( X->p != NULL ) - { - memcpy( p, X->p, X->n * ciL ); - bzero( X->p, X->n * ciL ); - free( X->p ); - } - - X->n = nblimbs; - X->p = p; - } - - return( 0 ); -} - -/* - * Resize down as much as possible, - * while keeping at least the specified number of limbs - */ -int esp_mpi_shrink( mpi *X, size_t nblimbs ) -{ - esp_mpi_uint *p; - size_t i; - - /* Actually resize up in this case */ - if( X->n <= nblimbs ) - return( esp_mpi_grow( X, nblimbs ) ); - - for( i = X->n - 1; i > 0; i-- ) - if( X->p[i] != 0 ) - break; - i++; - - if( i < nblimbs ) - i = nblimbs; - - if( ( p = calloc( i, ciL ) ) == NULL ) - return( ERR_MPI_ALLOC_FAILED ); - - if( X->p != NULL ) - { - memcpy( p, X->p, i * ciL ); - bzero( X->p, X->n * ciL ); - free( X->p ); - } - - X->n = i; - X->p = p; - - return( 0 ); -} - -/* - * Copy the contents of Y into X - */ -int esp_mpi_copy( mpi *X, const mpi *Y ) -{ - int ret; - size_t i; - - if( X == Y ) - return( 0 ); - - if( Y->p == NULL ) - { - esp_mpi_free( X ); - return( 0 ); - } - - for( i = Y->n - 1; i > 0; i-- ) - if( Y->p[i] != 0 ) - break; - i++; - - X->s = Y->s; - - MPI_CHK( esp_mpi_grow( X, i ) ); - - memset( X->p, 0, X->n * ciL ); - memcpy( X->p, Y->p, i * ciL ); - -cleanup: - - return( ret ); -} - -/* - * Swap the contents of X and Y - */ -void esp_mpi_swap( mpi *X, mpi *Y ) -{ - mpi T; - - memcpy( &T, X, sizeof( mpi ) ); - memcpy( X, Y, sizeof( mpi ) ); - memcpy( Y, &T, sizeof( mpi ) ); -} - -/* - * Conditionally assign X = Y, without leaking information - * about whether the assignment was made or not. - * (Leaking information about the respective sizes of X and Y is ok however.) - */ -int esp_mpi_safe_cond_assign( mpi *X, const mpi *Y, unsigned char assign ) -{ - int ret = 0; - size_t i; - - /* make sure assign is 0 or 1 in a time-constant manner */ - assign = (assign | (unsigned char)-assign) >> 7; - - MPI_CHK( esp_mpi_grow( X, Y->n ) ); - - X->s = X->s * ( 1 - assign ) + Y->s * assign; - - for( i = 0; i < Y->n; i++ ) - X->p[i] = X->p[i] * ( 1 - assign ) + Y->p[i] * assign; - - for( ; i < X->n; i++ ) - X->p[i] *= ( 1 - assign ); - -cleanup: - return( ret ); -} - -/* - * Conditionally swap X and Y, without leaking information - * about whether the swap was made or not. - * Here it is not ok to simply swap the pointers, which whould lead to - * different memory access patterns when X and Y are used afterwards. - */ -int esp_mpi_safe_cond_swap( mpi *X, mpi *Y, unsigned char swap ) -{ - int ret, s; - size_t i; - esp_mpi_uint tmp; - - if( X == Y ) - return( 0 ); - - /* make sure swap is 0 or 1 in a time-constant manner */ - swap = (swap | (unsigned char)-swap) >> 7; - - MPI_CHK( esp_mpi_grow( X, Y->n ) ); - MPI_CHK( esp_mpi_grow( Y, X->n ) ); - - s = X->s; - X->s = X->s * ( 1 - swap ) + Y->s * swap; - Y->s = Y->s * ( 1 - swap ) + s * swap; - - - for( i = 0; i < X->n; i++ ) - { - tmp = X->p[i]; - X->p[i] = X->p[i] * ( 1 - swap ) + Y->p[i] * swap; - Y->p[i] = Y->p[i] * ( 1 - swap ) + tmp * swap; - } - -cleanup: - return( ret ); -} - -/* - * Set value from integer - */ -int esp_mpi_lset( mpi *X, esp_mpi_sint z ) -{ - int ret; - - MPI_CHK( esp_mpi_grow( X, 1 ) ); - memset( X->p, 0, X->n * ciL ); - - X->p[0] = ( z < 0 ) ? -z : z; - X->s = ( z < 0 ) ? -1 : 1; - -cleanup: - - return( ret ); -} - -/* - * Get a specific bit - */ -int esp_mpi_get_bit( const mpi *X, size_t pos ) -{ - if( X->n * biL <= pos ) - return( 0 ); - - return( ( X->p[pos / biL] >> ( pos % biL ) ) & 0x01 ); -} - -/* - * Set a bit to a specific value of 0 or 1 - */ -int esp_mpi_set_bit( mpi *X, size_t pos, unsigned char val ) -{ - int ret = 0; - size_t off = pos / biL; - size_t idx = pos % biL; - - if( val != 0 && val != 1 ) - return( ERR_MPI_BAD_INPUT_DATA ); - - if( X->n * biL <= pos ) - { - if( val == 0 ) - return( 0 ); - - MPI_CHK( esp_mpi_grow( X, off + 1 ) ); - } - - X->p[off] &= ~( (esp_mpi_uint) 0x01 << idx ); - X->p[off] |= (esp_mpi_uint) val << idx; - -cleanup: - - return( ret ); -} - -/* - * Return the number of less significant zero-bits - */ -size_t esp_mpi_lsb( const mpi *X ) -{ - size_t i, j, count = 0; - - for( i = 0; i < X->n; i++ ) - for( j = 0; j < biL; j++, count++ ) - if( ( ( X->p[i] >> j ) & 1 ) != 0 ) - return( count ); - - return( 0 ); -} - -/* - * Count leading zero bits in a given integer - */ -static size_t clz( const esp_mpi_uint x ) -{ - size_t j; - esp_mpi_uint mask = (esp_mpi_uint) 1 << (biL - 1); - - for( j = 0; j < biL; j++ ) - { - if( x & mask ) break; - - mask >>= 1; - } - - return j; -} - -/* - * Return the number of bits - */ -size_t esp_mpi_bitlen( const mpi *X ) -{ - size_t i, j; - - if( X->n == 0 ) - return( 0 ); - - for( i = X->n - 1; i > 0; i-- ) - if( X->p[i] != 0 ) - break; - - j = biL - clz( X->p[i] ); - - return( ( i * biL ) + j ); -} - -/* - * Return the total size in bytes - */ -size_t esp_mpi_size( const mpi *X ) -{ - return( ( esp_mpi_bitlen( X ) + 7 ) >> 3 ); -} - -/* - * Convert an ASCII character to digit value - */ -static int esp_mpi_get_digit( esp_mpi_uint *d, int radix, char c ) -{ - *d = 255; - - if( c >= 0x30 && c <= 0x39 ) *d = c - 0x30; - if( c >= 0x41 && c <= 0x46 ) *d = c - 0x37; - if( c >= 0x61 && c <= 0x66 ) *d = c - 0x57; - - if( *d >= (esp_mpi_uint) radix ) - return( ERR_MPI_INVALID_CHARACTER ); - - return( 0 ); -} - -/* - * Import from an ASCII string - */ -int esp_mpi_read_string( mpi *X, int radix, const char *s ) -{ - int ret; - size_t i, j, slen, n; - esp_mpi_uint d; - mpi T; - - if( radix < 2 || radix > 16 ) - return( ERR_MPI_BAD_INPUT_DATA ); - - esp_mpi_init( &T ); - - slen = strlen( s ); - - if( radix == 16 ) - { - if( slen > MPI_SIZE_T_MAX >> 2 ) - return( ERR_MPI_BAD_INPUT_DATA ); - - n = BITS_TO_LIMBS( slen << 2 ); - - MPI_CHK( esp_mpi_grow( X, n ) ); - MPI_CHK( esp_mpi_lset( X, 0 ) ); - - for( i = slen, j = 0; i > 0; i--, j++ ) - { - if( i == 1 && s[i - 1] == '-' ) - { - X->s = -1; - break; - } - - MPI_CHK( esp_mpi_get_digit( &d, radix, s[i - 1] ) ); - X->p[j / ( 2 * ciL )] |= d << ( ( j % ( 2 * ciL ) ) << 2 ); - } - } - else - { - MPI_CHK( esp_mpi_lset( X, 0 ) ); - - for( i = 0; i < slen; i++ ) - { - if( i == 0 && s[i] == '-' ) - { - X->s = -1; - continue; - } - - MPI_CHK( esp_mpi_get_digit( &d, radix, s[i] ) ); - MPI_CHK( esp_mpi_mul_int( &T, X, radix ) ); - - if( X->s == 1 ) - { - MPI_CHK( esp_mpi_add_int( X, &T, d ) ); - } - else - { - MPI_CHK( esp_mpi_sub_int( X, &T, d ) ); - } - } - } - -cleanup: - - esp_mpi_free( &T ); - - return( ret ); -} - -/* - * Helper to write the digits high-order first - */ -static int esp_mpi_write_hlp( mpi *X, int radix, char **p ) -{ - int ret; - esp_mpi_uint r; - - if( radix < 2 || radix > 16 ) - return( ERR_MPI_BAD_INPUT_DATA ); - - MPI_CHK( esp_mpi_mod_int( &r, X, radix ) ); - MPI_CHK( esp_mpi_div_int( X, NULL, X, radix ) ); - - if( esp_mpi_cmp_int( X, 0 ) != 0 ) - MPI_CHK( esp_mpi_write_hlp( X, radix, p ) ); - - if( r < 10 ) - *(*p)++ = (char)( r + 0x30 ); - else - *(*p)++ = (char)( r + 0x37 ); - -cleanup: - - return( ret ); -} - -/* - * Export into an ASCII string - */ -int esp_mpi_write_string( const mpi *X, int radix, - char *buf, size_t buflen, size_t *olen ) -{ - int ret = 0; - size_t n; - char *p; - mpi T; - - if( radix < 2 || radix > 16 ) - return( ERR_MPI_BAD_INPUT_DATA ); - - n = esp_mpi_bitlen( X ); - if( radix >= 4 ) n >>= 1; - if( radix >= 16 ) n >>= 1; - n += 3; - - if( buflen < n ) - { - *olen = n; - return( ERR_MPI_BUFFER_TOO_SMALL ); - } - - p = buf; - esp_mpi_init( &T ); - - if( X->s == -1 ) - *p++ = '-'; - - if( radix == 16 ) - { - int c; - size_t i, j, k; - - for( i = X->n, k = 0; i > 0; i-- ) - { - for( j = ciL; j > 0; j-- ) - { - c = ( X->p[i - 1] >> ( ( j - 1 ) << 3) ) & 0xFF; - - if( c == 0 && k == 0 && ( i + j ) != 2 ) - continue; - - *(p++) = "0123456789ABCDEF" [c / 16]; - *(p++) = "0123456789ABCDEF" [c % 16]; - k = 1; - } - } - } - else - { - MPI_CHK( esp_mpi_copy( &T, X ) ); - - if( T.s == -1 ) - T.s = 1; - - MPI_CHK( esp_mpi_write_hlp( &T, radix, &p ) ); - } - - *p++ = '\0'; - *olen = p - buf; - -cleanup: - - esp_mpi_free( &T ); - - return( ret ); -} - -/* - * Import X from unsigned binary data, big endian - */ -int esp_mpi_read_binary( mpi *X, const unsigned char *buf, size_t buflen ) -{ - int ret; - size_t i, j, n; - - for( n = 0; n < buflen; n++ ) - if( buf[n] != 0 ) - break; - - MPI_CHK( esp_mpi_grow( X, CHARS_TO_LIMBS( buflen - n ) ) ); - MPI_CHK( esp_mpi_lset( X, 0 ) ); - - for( i = buflen, j = 0; i > n; i--, j++ ) - X->p[j / ciL] |= ((esp_mpi_uint) buf[i - 1]) << ((j % ciL) << 3); - -cleanup: - - return( ret ); -} - -/* - * Export X into unsigned binary data, big endian - */ -int esp_mpi_write_binary( const mpi *X, unsigned char *buf, size_t buflen ) -{ - size_t i, j, n; - - n = esp_mpi_size( X ); - - if( buflen < n ) - return( ERR_MPI_BUFFER_TOO_SMALL ); - - memset( buf, 0, buflen ); - - for( i = buflen - 1, j = 0; n > 0; i--, j++, n-- ) - buf[i] = (unsigned char)( X->p[j / ciL] >> ((j % ciL) << 3) ); - - return( 0 ); -} - -/* - * Left-shift: X <<= count - */ -int esp_mpi_shift_l( mpi *X, size_t count ) -{ - int ret; - size_t i, v0, t1; - esp_mpi_uint r0 = 0, r1; - - v0 = count / (biL ); - t1 = count & (biL - 1); - - i = esp_mpi_bitlen( X ) + count; - - if( X->n * biL < i ) - MPI_CHK( esp_mpi_grow( X, BITS_TO_LIMBS( i ) ) ); - - ret = 0; - - /* - * shift by count / limb_size - */ - if( v0 > 0 ) - { - for( i = X->n; i > v0; i-- ) - X->p[i - 1] = X->p[i - v0 - 1]; - - for( ; i > 0; i-- ) - X->p[i - 1] = 0; - } - - /* - * shift by count % limb_size - */ - if( t1 > 0 ) - { - for( i = v0; i < X->n; i++ ) - { - r1 = X->p[i] >> (biL - t1); - X->p[i] <<= t1; - X->p[i] |= r0; - r0 = r1; - } - } - -cleanup: - - return( ret ); -} - -/* - * Right-shift: X >>= count - */ -int esp_mpi_shift_r( mpi *X, size_t count ) -{ - size_t i, v0, v1; - esp_mpi_uint r0 = 0, r1; - - v0 = count / biL; - v1 = count & (biL - 1); - - if( v0 > X->n || ( v0 == X->n && v1 > 0 ) ) - return esp_mpi_lset( X, 0 ); - - /* - * shift by count / limb_size - */ - if( v0 > 0 ) - { - for( i = 0; i < X->n - v0; i++ ) - X->p[i] = X->p[i + v0]; - - for( ; i < X->n; i++ ) - X->p[i] = 0; - } - - /* - * shift by count % limb_size - */ - if( v1 > 0 ) - { - for( i = X->n; i > 0; i-- ) - { - r1 = X->p[i - 1] << (biL - v1); - X->p[i - 1] >>= v1; - X->p[i - 1] |= r0; - r0 = r1; - } - } - - return( 0 ); -} - -/* - * Compare unsigned values - */ -int esp_mpi_cmp_abs( const mpi *X, const mpi *Y ) -{ - size_t i, j; - - for( i = X->n; i > 0; i-- ) - if( X->p[i - 1] != 0 ) - break; - - for( j = Y->n; j > 0; j-- ) - if( Y->p[j - 1] != 0 ) - break; - - if( i == 0 && j == 0 ) - return( 0 ); - - if( i > j ) return( 1 ); - if( j > i ) return( -1 ); - - for( ; i > 0; i-- ) - { - if( X->p[i - 1] > Y->p[i - 1] ) return( 1 ); - if( X->p[i - 1] < Y->p[i - 1] ) return( -1 ); - } - - return( 0 ); -} - -/* - * Compare signed values - */ -int esp_mpi_cmp_mpi( const mpi *X, const mpi *Y ) -{ - size_t i, j; - - for( i = X->n; i > 0; i-- ) - if( X->p[i - 1] != 0 ) - break; - - for( j = Y->n; j > 0; j-- ) - if( Y->p[j - 1] != 0 ) - break; - - if( i == 0 && j == 0 ) - return( 0 ); - - if( i > j ) return( X->s ); - if( j > i ) return( -Y->s ); - - if( X->s > 0 && Y->s < 0 ) return( 1 ); - if( Y->s > 0 && X->s < 0 ) return( -1 ); - - for( ; i > 0; i-- ) - { - if( X->p[i - 1] > Y->p[i - 1] ) return( X->s ); - if( X->p[i - 1] < Y->p[i - 1] ) return( -X->s ); - } - - return( 0 ); -} - -/* - * Compare signed values - */ -int esp_mpi_cmp_int( const mpi *X, esp_mpi_sint z ) -{ - mpi Y; - esp_mpi_uint p[1]; - - *p = ( z < 0 ) ? -z : z; - Y.s = ( z < 0 ) ? -1 : 1; - Y.n = 1; - Y.p = p; - - return( esp_mpi_cmp_mpi( X, &Y ) ); -} - -/* - * Unsigned addition: X = |A| + |B| (HAC 14.7) - */ -int esp_mpi_add_abs( mpi *X, const mpi *A, const mpi *B ) -{ - int ret; - size_t i, j; - esp_mpi_uint *o, *p, c; - - if( X == B ) - { - const mpi *T = A; A = X; B = T; - } - - if( X != A ) - MPI_CHK( esp_mpi_copy( X, A ) ); - - /* - * X should always be positive as a result of unsigned additions. - */ - X->s = 1; - - for( j = B->n; j > 0; j-- ) - if( B->p[j - 1] != 0 ) - break; - - MPI_CHK( esp_mpi_grow( X, j ) ); - - o = B->p; p = X->p; c = 0; - - for( i = 0; i < j; i++, o++, p++ ) - { - *p += c; c = ( *p < c ); - *p += *o; c += ( *p < *o ); - } - - while( c != 0 ) - { - if( i >= X->n ) - { - MPI_CHK( esp_mpi_grow( X, i + 1 ) ); - p = X->p + i; - } - - *p += c; c = ( *p < c ); i++; p++; - } - -cleanup: - - return( ret ); -} - -/* - * Helper for mpi subtraction - */ -static void esp_mpi_sub_hlp( size_t n, esp_mpi_uint *s, esp_mpi_uint *d ) -{ - size_t i; - esp_mpi_uint c, z; - - for( i = c = 0; i < n; i++, s++, d++ ) - { - z = ( *d < c ); *d -= c; - c = ( *d < *s ) + z; *d -= *s; - } - - while( c != 0 ) - { - z = ( *d < c ); *d -= c; - c = z; i++; d++; - } -} - -/* - * Unsigned subtraction: X = |A| - |B| (HAC 14.9) - */ -int esp_mpi_sub_abs( mpi *X, const mpi *A, const mpi *B ) -{ - mpi TB; - int ret; - size_t n; - - if( esp_mpi_cmp_abs( A, B ) < 0 ) - return( ERR_MPI_NEGATIVE_VALUE ); - - esp_mpi_init( &TB ); - - if( X == B ) - { - MPI_CHK( esp_mpi_copy( &TB, B ) ); - B = &TB; - } - - if( X != A ) - MPI_CHK( esp_mpi_copy( X, A ) ); - - /* - * X should always be positive as a result of unsigned subtractions. - */ - X->s = 1; - - ret = 0; - - for( n = B->n; n > 0; n-- ) - if( B->p[n - 1] != 0 ) - break; - - esp_mpi_sub_hlp( n, B->p, X->p ); - -cleanup: - - esp_mpi_free( &TB ); - - return( ret ); -} - -/* - * Signed addition: X = A + B - */ -int esp_mpi_add_mpi( mpi *X, const mpi *A, const mpi *B ) -{ - int ret, s = A->s; - - if( A->s * B->s < 0 ) - { - if( esp_mpi_cmp_abs( A, B ) >= 0 ) - { - MPI_CHK( esp_mpi_sub_abs( X, A, B ) ); - X->s = s; - } - else - { - MPI_CHK( esp_mpi_sub_abs( X, B, A ) ); - X->s = -s; - } - } - else - { - MPI_CHK( esp_mpi_add_abs( X, A, B ) ); - X->s = s; - } - -cleanup: - - return( ret ); -} - -/* - * Signed subtraction: X = A - B - */ -int esp_mpi_sub_mpi( mpi *X, const mpi *A, const mpi *B ) -{ - int ret, s = A->s; - - if( A->s * B->s > 0 ) - { - if( esp_mpi_cmp_abs( A, B ) >= 0 ) - { - MPI_CHK( esp_mpi_sub_abs( X, A, B ) ); - X->s = s; - } - else - { - MPI_CHK( esp_mpi_sub_abs( X, B, A ) ); - X->s = -s; - } - } - else - { - MPI_CHK( esp_mpi_add_abs( X, A, B ) ); - X->s = s; - } - -cleanup: - - return( ret ); -} - -/* - * Signed addition: X = A + b - */ -int esp_mpi_add_int( mpi *X, const mpi *A, esp_mpi_sint b ) -{ - mpi _B; - esp_mpi_uint p[1]; - - p[0] = ( b < 0 ) ? -b : b; - _B.s = ( b < 0 ) ? -1 : 1; - _B.n = 1; - _B.p = p; - - return( esp_mpi_add_mpi( X, A, &_B ) ); -} - -/* - * Signed subtraction: X = A - b - */ -int esp_mpi_sub_int( mpi *X, const mpi *A, esp_mpi_sint b ) -{ - mpi _B; - esp_mpi_uint p[1]; - - p[0] = ( b < 0 ) ? -b : b; - _B.s = ( b < 0 ) ? -1 : 1; - _B.n = 1; - _B.p = p; - - return( esp_mpi_sub_mpi( X, A, &_B ) ); -} - -/* - * Helper for mpi multiplication - */ -static void esp_mpi_mul_hlp( size_t i, esp_mpi_uint *s, esp_mpi_uint *d, esp_mpi_uint b ) -{ - -} - -/* - * Baseline multiplication: X = A * B (HAC 14.12) - */ - -static int mul_pram_alloc( mpi *X, const mpi *A, const mpi *B, char **pA, char **pB, char **pX, size_t *bites) -{ - char *sa, *sb, *sx; -// int algn; - int words, bytes; - int abytes, bbytes; - - if (A->n > B->n) - words = A->n; - else - words = B->n; - - bytes = (words / 16 + ((words % 16) ? 1 : 0 )) * 16 * 4 * 2; - - abytes = A->n * 4; - bbytes = B->n * 4; - - sa = malloc(bytes); - if (!sa) { - return -1; - } - - sb = malloc(bytes); - if (!sb) { - free(sa); - return -1; - } - - sx = malloc(bytes); - if (!sx) { - free(sa); - free(sb); - return -1; - } - - memcpy(sa, A->p, abytes); - memset(sa + abytes, 0, bytes - abytes); - - memcpy(sb, B->p, bbytes); - memset(sb + bbytes, 0, bytes - bbytes); - - *pA = sa; - *pB = sb; - - *pX = sx; - - *bites = bytes * 4; - - return 0; -} - -void mul_pram_free(char **pA, char **pB, char **pX) -{ - free(*pA); - *pA = NULL; - - free(*pB); - *pB = NULL; - - free(*pX); - *pX = NULL; -} - -int esp_mpi_mul_mpi( mpi *X, const mpi *A, const mpi *B ) -{ - int ret = -1; - size_t i, j; - char *s1 = NULL, *s2 = NULL, *dest = NULL; - size_t bites; - - mpi TA, TB; - - esp_mpi_init( &TA ); esp_mpi_init( &TB ); - - if( X == A ) { MPI_CHK( esp_mpi_copy( &TA, A ) ); A = &TA; } - if( X == B ) { MPI_CHK( esp_mpi_copy( &TB, B ) ); B = &TB; } - - for( i = A->n; i > 0; i-- ) - if( A->p[i - 1] != 0 ) - break; - - for( j = B->n; j > 0; j-- ) - if( B->p[j - 1] != 0 ) - break; - - MPI_CHK( esp_mpi_grow( X, i + j ) ); - MPI_CHK( esp_mpi_lset( X, 0 ) ); - - if (mul_pram_alloc(X, A, B, &s1, &s2, &dest, &bites)) { - goto cleanup; - } - - esp_mpi_acquire_hardware(); - if (ets_bigint_mult_prepare((uint32_t *)s1, (uint32_t *)s2, bites)){ - ets_bigint_wait_finish(); - if (ets_bigint_mult_getz((uint32_t *)dest, bites) == true) { - memcpy(X->p, dest, (i + j) * 4); - ret = 0; - } else { - esp_mpi_printf("ets_bigint_mult_getz failed\n"); - } - } else{ - esp_mpi_printf("Baseline multiplication failed\n"); - } - esp_mpi_release_hardware(); - - X->s = A->s * B->s; - - mul_pram_free(&s1, &s2, &dest); - -cleanup: - - esp_mpi_free( &TB ); esp_mpi_free( &TA ); - - return( ret ); -} - -/* - * Baseline multiplication: X = A * b - */ -int esp_mpi_mul_int( mpi *X, const mpi *A, esp_mpi_uint b ) -{ - mpi _B; - esp_mpi_uint p[1]; - - _B.s = 1; - _B.n = 1; - _B.p = p; - p[0] = b; - - return( esp_mpi_mul_mpi( X, A, &_B ) ); -} - -/* - * Unsigned integer divide - double esp_mpi_uint dividend, u1/u0, and - * esp_mpi_uint divisor, d - */ -static esp_mpi_uint int_div_int( esp_mpi_uint u1, - esp_mpi_uint u0, esp_mpi_uint d, esp_mpi_uint *r ) -{ -#if defined(HAVE_UDBL) - t_udbl dividend, quotient; -#else - const esp_mpi_uint radix = (esp_mpi_uint) 1 << biH; - const esp_mpi_uint uint_halfword_mask = ( (esp_mpi_uint) 1 << biH ) - 1; - esp_mpi_uint d0, d1, q0, q1, rAX, r0, quotient; - esp_mpi_uint u0_msw, u0_lsw; - size_t s; -#endif - - /* - * Check for overflow - */ - if( 0 == d || u1 >= d ) - { - if (r != NULL) *r = ~0; - - return ( ~0 ); - } - -#if defined(HAVE_UDBL) - dividend = (t_udbl) u1 << biL; - dividend |= (t_udbl) u0; - quotient = dividend / d; - if( quotient > ( (t_udbl) 1 << biL ) - 1 ) - quotient = ( (t_udbl) 1 << biL ) - 1; - - if( r != NULL ) - *r = (esp_mpi_uint)( dividend - (quotient * d ) ); - - return (esp_mpi_uint) quotient; -#else - - /* - * Algorithm D, Section 4.3.1 - The Art of Computer Programming - * Vol. 2 - Seminumerical Algorithms, Knuth - */ - - /* - * Normalize the divisor, d, and dividend, u0, u1 - */ - s = clz( d ); - d = d << s; - - u1 = u1 << s; - u1 |= ( u0 >> ( biL - s ) ) & ( -(esp_mpi_sint)s >> ( biL - 1 ) ); - u0 = u0 << s; - - d1 = d >> biH; - d0 = d & uint_halfword_mask; - - u0_msw = u0 >> biH; - u0_lsw = u0 & uint_halfword_mask; - - /* - * Find the first quotient and remainder - */ - q1 = u1 / d1; - r0 = u1 - d1 * q1; - - while( q1 >= radix || ( q1 * d0 > radix * r0 + u0_msw ) ) - { - q1 -= 1; - r0 += d1; - - if ( r0 >= radix ) break; - } - - rAX = ( u1 * radix ) + ( u0_msw - q1 * d ); - q0 = rAX / d1; - r0 = rAX - q0 * d1; - - while( q0 >= radix || ( q0 * d0 > radix * r0 + u0_lsw ) ) - { - q0 -= 1; - r0 += d1; - - if ( r0 >= radix ) break; - } - - if (r != NULL) - *r = ( rAX * radix + u0_lsw - q0 * d ) >> s; - - quotient = q1 * radix + q0; - - return quotient; -#endif -} - -/* - * Division by mpi: A = Q * B + R (HAC 14.20) - */ -int esp_mpi_div_mpi( mpi *Q, mpi *R, const mpi *A, const mpi *B ) -{ - int ret; - size_t i, n, t, k; - mpi X, Y, Z, T1, T2; - - if( esp_mpi_cmp_int( B, 0 ) == 0 ) - return( ERR_MPI_DIVISION_BY_ZERO ); - - esp_mpi_init( &X ); esp_mpi_init( &Y ); esp_mpi_init( &Z ); - esp_mpi_init( &T1 ); esp_mpi_init( &T2 ); - - if( esp_mpi_cmp_abs( A, B ) < 0 ) - { - if( Q != NULL ) MPI_CHK( esp_mpi_lset( Q, 0 ) ); - if( R != NULL ) MPI_CHK( esp_mpi_copy( R, A ) ); - return( 0 ); - } - - MPI_CHK( esp_mpi_copy( &X, A ) ); - MPI_CHK( esp_mpi_copy( &Y, B ) ); - X.s = Y.s = 1; - - MPI_CHK( esp_mpi_grow( &Z, A->n + 2 ) ); - MPI_CHK( esp_mpi_lset( &Z, 0 ) ); - MPI_CHK( esp_mpi_grow( &T1, 2 ) ); - MPI_CHK( esp_mpi_grow( &T2, 3 ) ); - - k = esp_mpi_bitlen( &Y ) % biL; - if( k < biL - 1 ) - { - k = biL - 1 - k; - MPI_CHK( esp_mpi_shift_l( &X, k ) ); - MPI_CHK( esp_mpi_shift_l( &Y, k ) ); - } - else k = 0; - - n = X.n - 1; - t = Y.n - 1; - MPI_CHK( esp_mpi_shift_l( &Y, biL * ( n - t ) ) ); - - while( esp_mpi_cmp_mpi( &X, &Y ) >= 0 ) - { - Z.p[n - t]++; - MPI_CHK( esp_mpi_sub_mpi( &X, &X, &Y ) ); - } - MPI_CHK( esp_mpi_shift_r( &Y, biL * ( n - t ) ) ); - - for( i = n; i > t ; i-- ) - { - if( X.p[i] >= Y.p[t] ) - Z.p[i - t - 1] = ~0; - else - { - Z.p[i - t - 1] = int_div_int( X.p[i], X.p[i - 1], - Y.p[t], NULL); - } - - Z.p[i - t - 1]++; - do - { - Z.p[i - t - 1]--; - - MPI_CHK( esp_mpi_lset( &T1, 0 ) ); - T1.p[0] = ( t < 1 ) ? 0 : Y.p[t - 1]; - T1.p[1] = Y.p[t]; - MPI_CHK( esp_mpi_mul_int( &T1, &T1, Z.p[i - t - 1] ) ); - - MPI_CHK( esp_mpi_lset( &T2, 0 ) ); - T2.p[0] = ( i < 2 ) ? 0 : X.p[i - 2]; - T2.p[1] = ( i < 1 ) ? 0 : X.p[i - 1]; - T2.p[2] = X.p[i]; - } - while( esp_mpi_cmp_mpi( &T1, &T2 ) > 0 ); - - MPI_CHK( esp_mpi_mul_int( &T1, &Y, Z.p[i - t - 1] ) ); - MPI_CHK( esp_mpi_shift_l( &T1, biL * ( i - t - 1 ) ) ); - MPI_CHK( esp_mpi_sub_mpi( &X, &X, &T1 ) ); - - if( esp_mpi_cmp_int( &X, 0 ) < 0 ) - { - MPI_CHK( esp_mpi_copy( &T1, &Y ) ); - MPI_CHK( esp_mpi_shift_l( &T1, biL * ( i - t - 1 ) ) ); - MPI_CHK( esp_mpi_add_mpi( &X, &X, &T1 ) ); - Z.p[i - t - 1]--; - } - } - - if( Q != NULL ) - { - MPI_CHK( esp_mpi_copy( Q, &Z ) ); - Q->s = A->s * B->s; - } - - if( R != NULL ) - { - MPI_CHK( esp_mpi_shift_r( &X, k ) ); - X.s = A->s; - MPI_CHK( esp_mpi_copy( R, &X ) ); - - if( esp_mpi_cmp_int( R, 0 ) == 0 ) - R->s = 1; - } - -cleanup: - - esp_mpi_free( &X ); esp_mpi_free( &Y ); esp_mpi_free( &Z ); - esp_mpi_free( &T1 ); esp_mpi_free( &T2 ); - - return( ret ); -} - -/* - * Division by int: A = Q * b + R - */ -int esp_mpi_div_int( mpi *Q, mpi *R, const mpi *A, esp_mpi_sint b ) -{ - mpi _B; - esp_mpi_uint p[1]; - - p[0] = ( b < 0 ) ? -b : b; - _B.s = ( b < 0 ) ? -1 : 1; - _B.n = 1; - _B.p = p; - - return( esp_mpi_div_mpi( Q, R, A, &_B ) ); -} - -/* - * Modulo: R = A mod B - */ -int esp_mpi_mod_mpi( mpi *R, const mpi *A, const mpi *B ) -{ - int ret; - - if( esp_mpi_cmp_int( B, 0 ) < 0 ) - return( ERR_MPI_NEGATIVE_VALUE ); - - MPI_CHK( esp_mpi_div_mpi( NULL, R, A, B ) ); - - while( esp_mpi_cmp_int( R, 0 ) < 0 ) - MPI_CHK( esp_mpi_add_mpi( R, R, B ) ); - - while( esp_mpi_cmp_mpi( R, B ) >= 0 ) - MPI_CHK( esp_mpi_sub_mpi( R, R, B ) ); - -cleanup: - - return( ret ); -} - -/* - * Modulo: r = A mod b - */ -int esp_mpi_mod_int( esp_mpi_uint *r, const mpi *A, esp_mpi_sint b ) -{ - size_t i; - esp_mpi_uint x, y, z; - - if( b == 0 ) - return( ERR_MPI_DIVISION_BY_ZERO ); - - if( b < 0 ) - return( ERR_MPI_NEGATIVE_VALUE ); - - /* - * handle trivial cases - */ - if( b == 1 ) - { - *r = 0; - return( 0 ); - } - - if( b == 2 ) - { - *r = A->p[0] & 1; - return( 0 ); - } - - /* - * general case - */ - for( i = A->n, y = 0; i > 0; i-- ) - { - x = A->p[i - 1]; - y = ( y << biH ) | ( x >> biH ); - z = y / b; - y -= z * b; - - x <<= biH; - y = ( y << biH ) | ( x >> biH ); - z = y / b; - y -= z * b; - } - - /* - * If A is negative, then the current y represents a negative value. - * Flipping it to the positive side. - */ - if( A->s < 0 && y != 0 ) - y = b - y; - - *r = y; - - return( 0 ); -} - -/* - * Fast Montgomery initialization (thanks to Tom St Denis) - */ -static void esp_mpi_montg_init( esp_mpi_uint *mm, const mpi *N ) -{ - esp_mpi_uint x, m0 = N->p[0]; - unsigned int i; - - x = m0; - x += ( ( m0 + 2 ) & 4 ) << 1; - - for( i = biL; i >= 8; i /= 2 ) - x *= ( 2 - ( m0 * x ) ); - - *mm = ~x + 1; -} - -/* - * Montgomery multiplication: A = A * B * R^-1 mod N (HAC 14.36) - */ -static void esp_mpi_montmul( mpi *A, const mpi *B, const mpi *N, esp_mpi_uint mm, - const mpi *T ) -{ - size_t n, m; - esp_mpi_uint *d = NULL; - - memset( T->p, 0, T->n * ciL ); - - d = T->p; - n = N->n; - m = ( B->n < n ) ? B->n : n; - - esp_mpi_acquire_hardware(); - if (ets_bigint_montgomery_mult_prepare(N->p, B->p, d, m, n, false)) { - ets_bigint_wait_finish(); - - ets_bigint_montgomery_mult_getz(A->p, n); - } else{ - esp_mpi_printf("Montgomery multiplication failed\n"); - } - esp_mpi_release_hardware(); - -} - -/* - * Montgomery reduction: A = A * R^-1 mod N - */ -static void esp_mpi_montred( mpi *A, const mpi *N, esp_mpi_uint mm, const mpi *T ) -{ - esp_mpi_uint z = 1; - mpi U; - - U.n = U.s = (int) z; - U.p = &z; - - esp_mpi_montmul( A, &U, N, mm, T ); -} - -/* - * Sliding-window exponentiation: X = A^E mod N (HAC 14.85) - */ -int esp_mpi_exp_mod( mpi *X, const mpi *A, const mpi *E, const mpi *N, mpi *_RR ) -{ - int ret; - size_t wbits, wsize, one = 1; - size_t i, j, nblimbs; - size_t bufsize, nbits; - esp_mpi_uint ei, mm, state; - mpi RR, T, W[ 2 << MPI_WINDOW_SIZE ], Apos; - int neg; - - if( esp_mpi_cmp_int( N, 0 ) < 0 || ( N->p[0] & 1 ) == 0 ) - return( ERR_MPI_BAD_INPUT_DATA ); - - if( esp_mpi_cmp_int( E, 0 ) < 0 ) - return( ERR_MPI_BAD_INPUT_DATA ); - - /* - * Init temps and window size - */ - esp_mpi_montg_init( &mm, N ); - esp_mpi_init( &RR ); esp_mpi_init( &T ); - esp_mpi_init( &Apos ); - memset( W, 0, sizeof( W ) ); - - i = esp_mpi_bitlen( E ); - - wsize = ( i > 671 ) ? 6 : ( i > 239 ) ? 5 : - ( i > 79 ) ? 4 : ( i > 23 ) ? 3 : 1; - - if( wsize > MPI_WINDOW_SIZE ) - wsize = MPI_WINDOW_SIZE; - - j = N->n + 1; - MPI_CHK( esp_mpi_grow( X, j ) ); - MPI_CHK( esp_mpi_grow( &W[1], j ) ); - MPI_CHK( esp_mpi_grow( &T, j * 2 ) ); - - /* - * Compensate for negative A (and correct at the end) - */ - neg = ( A->s == -1 ); - if( neg ) - { - MPI_CHK( esp_mpi_copy( &Apos, A ) ); - Apos.s = 1; - A = &Apos; - } - - /* - * If 1st call, pre-compute R^2 mod N - */ - if( _RR == NULL || _RR->p == NULL ) - { - MPI_CHK( esp_mpi_lset( &RR, 1 ) ); - MPI_CHK( esp_mpi_shift_l( &RR, N->n * 2 * biL ) ); - MPI_CHK( esp_mpi_mod_mpi( &RR, &RR, N ) ); - - if( _RR != NULL ) - memcpy( _RR, &RR, sizeof( mpi ) ); - } - else - memcpy( &RR, _RR, sizeof( mpi ) ); - - /* - * W[1] = A * R^2 * R^-1 mod N = A * R mod N - */ - if( esp_mpi_cmp_mpi( A, N ) >= 0 ) - MPI_CHK( esp_mpi_mod_mpi( &W[1], A, N ) ); - else - MPI_CHK( esp_mpi_copy( &W[1], A ) ); - - esp_mpi_montmul( &W[1], &RR, N, mm, &T ); - - /* - * X = R^2 * R^-1 mod N = R mod N - */ - MPI_CHK( esp_mpi_copy( X, &RR ) ); - esp_mpi_montred( X, N, mm, &T ); - - if( wsize > 1 ) - { - /* - * W[1 << (wsize - 1)] = W[1] ^ (wsize - 1) - */ - j = one << ( wsize - 1 ); - - MPI_CHK( esp_mpi_grow( &W[j], N->n + 1 ) ); - MPI_CHK( esp_mpi_copy( &W[j], &W[1] ) ); - - for( i = 0; i < wsize - 1; i++ ) - esp_mpi_montmul( &W[j], &W[j], N, mm, &T ); - - /* - * W[i] = W[i - 1] * W[1] - */ - for( i = j + 1; i < ( one << wsize ); i++ ) - { - MPI_CHK( esp_mpi_grow( &W[i], N->n + 1 ) ); - MPI_CHK( esp_mpi_copy( &W[i], &W[i - 1] ) ); - - esp_mpi_montmul( &W[i], &W[1], N, mm, &T ); - } - } - - nblimbs = E->n; - bufsize = 0; - nbits = 0; - wbits = 0; - state = 0; - - while( 1 ) - { - if( bufsize == 0 ) - { - if( nblimbs == 0 ) - break; - - nblimbs--; - - bufsize = sizeof( esp_mpi_uint ) << 3; - } - - bufsize--; - - ei = (E->p[nblimbs] >> bufsize) & 1; - - /* - * skip leading 0s - */ - if( ei == 0 && state == 0 ) - continue; - - if( ei == 0 && state == 1 ) - { - /* - * out of window, square X - */ - esp_mpi_montmul( X, X, N, mm, &T ); - continue; - } - - /* - * add ei to current window - */ - state = 2; - - nbits++; - wbits |= ( ei << ( wsize - nbits ) ); - - if( nbits == wsize ) - { - /* - * X = X^wsize R^-1 mod N - */ - for( i = 0; i < wsize; i++ ) - esp_mpi_montmul( X, X, N, mm, &T ); - - /* - * X = X * W[wbits] R^-1 mod N - */ - esp_mpi_montmul( X, &W[wbits], N, mm, &T ); - - state--; - nbits = 0; - wbits = 0; - } - } - - /* - * process the remaining bits - */ - for( i = 0; i < nbits; i++ ) - { - esp_mpi_montmul( X, X, N, mm, &T ); - - wbits <<= 1; - - if( ( wbits & ( one << wsize ) ) != 0 ) - esp_mpi_montmul( X, &W[1], N, mm, &T ); - } - - /* - * X = A^E * R * R^-1 mod N = A^E mod N - */ - esp_mpi_montred( X, N, mm, &T ); - - if( neg ) - { - X->s = -1; - MPI_CHK( esp_mpi_add_mpi( X, N, X ) ); - } - -cleanup: - - for( i = ( one << ( wsize - 1 ) ); i < ( one << wsize ); i++ ) - esp_mpi_free( &W[i] ); - - esp_mpi_free( &W[1] ); esp_mpi_free( &T ); esp_mpi_free( &Apos ); - - if( _RR == NULL || _RR->p == NULL ) - esp_mpi_free( &RR ); - - return( ret ); -} - -/* - * Greatest common divisor: G = gcd(A, B) (HAC 14.54) - */ -int esp_mpi_gcd( mpi *G, const mpi *A, const mpi *B ) -{ - int ret; - size_t lz, lzt; - mpi TG, TA, TB; - - esp_mpi_init( &TG ); esp_mpi_init( &TA ); esp_mpi_init( &TB ); - - MPI_CHK( esp_mpi_copy( &TA, A ) ); - MPI_CHK( esp_mpi_copy( &TB, B ) ); - - lz = esp_mpi_lsb( &TA ); - lzt = esp_mpi_lsb( &TB ); - - if( lzt < lz ) - lz = lzt; - - MPI_CHK( esp_mpi_shift_r( &TA, lz ) ); - MPI_CHK( esp_mpi_shift_r( &TB, lz ) ); - - TA.s = TB.s = 1; - - while( esp_mpi_cmp_int( &TA, 0 ) != 0 ) - { - MPI_CHK( esp_mpi_shift_r( &TA, esp_mpi_lsb( &TA ) ) ); - MPI_CHK( esp_mpi_shift_r( &TB, esp_mpi_lsb( &TB ) ) ); - - if( esp_mpi_cmp_mpi( &TA, &TB ) >= 0 ) - { - MPI_CHK( esp_mpi_sub_abs( &TA, &TA, &TB ) ); - MPI_CHK( esp_mpi_shift_r( &TA, 1 ) ); - } - else - { - MPI_CHK( esp_mpi_sub_abs( &TB, &TB, &TA ) ); - MPI_CHK( esp_mpi_shift_r( &TB, 1 ) ); - } - } - - MPI_CHK( esp_mpi_shift_l( &TB, lz ) ); - MPI_CHK( esp_mpi_copy( G, &TB ) ); - -cleanup: - - esp_mpi_free( &TG ); esp_mpi_free( &TA ); esp_mpi_free( &TB ); - - return( ret ); -} - -/* - * Fill X with size bytes of random. - * - * Use a temporary bytes representation to make sure the result is the same - * regardless of the platform endianness (useful when f_rng is actually - * deterministic, eg for tests). - */ -int esp_mpi_fill_random( mpi *X, size_t size, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng ) -{ - int ret; - unsigned char buf[MPI_MAX_SIZE]; - - if( size > MPI_MAX_SIZE ) - return( ERR_MPI_BAD_INPUT_DATA ); - - MPI_CHK( f_rng( p_rng, buf, size ) ); - MPI_CHK( esp_mpi_read_binary( X, buf, size ) ); - -cleanup: - return( ret ); -} - -/* - * Modular inverse: X = A^-1 mod N (HAC 14.61 / 14.64) - */ -int esp_mpi_inv_mod( mpi *X, const mpi *A, const mpi *N ) -{ - int ret; - mpi G, TA, TU, U1, U2, TB, TV, V1, V2; - - if( esp_mpi_cmp_int( N, 0 ) <= 0 ) - return( ERR_MPI_BAD_INPUT_DATA ); - - esp_mpi_init( &TA ); esp_mpi_init( &TU ); esp_mpi_init( &U1 ); esp_mpi_init( &U2 ); - esp_mpi_init( &G ); esp_mpi_init( &TB ); esp_mpi_init( &TV ); - esp_mpi_init( &V1 ); esp_mpi_init( &V2 ); - - MPI_CHK( esp_mpi_gcd( &G, A, N ) ); - - if( esp_mpi_cmp_int( &G, 1 ) != 0 ) - { - ret = ERR_MPI_NOT_ACCEPTABLE; - goto cleanup; - } - - MPI_CHK( esp_mpi_mod_mpi( &TA, A, N ) ); - MPI_CHK( esp_mpi_copy( &TU, &TA ) ); - MPI_CHK( esp_mpi_copy( &TB, N ) ); - MPI_CHK( esp_mpi_copy( &TV, N ) ); - - MPI_CHK( esp_mpi_lset( &U1, 1 ) ); - MPI_CHK( esp_mpi_lset( &U2, 0 ) ); - MPI_CHK( esp_mpi_lset( &V1, 0 ) ); - MPI_CHK( esp_mpi_lset( &V2, 1 ) ); - - do - { - while( ( TU.p[0] & 1 ) == 0 ) - { - MPI_CHK( esp_mpi_shift_r( &TU, 1 ) ); - - if( ( U1.p[0] & 1 ) != 0 || ( U2.p[0] & 1 ) != 0 ) - { - MPI_CHK( esp_mpi_add_mpi( &U1, &U1, &TB ) ); - MPI_CHK( esp_mpi_sub_mpi( &U2, &U2, &TA ) ); - } - - MPI_CHK( esp_mpi_shift_r( &U1, 1 ) ); - MPI_CHK( esp_mpi_shift_r( &U2, 1 ) ); - } - - while( ( TV.p[0] & 1 ) == 0 ) - { - MPI_CHK( esp_mpi_shift_r( &TV, 1 ) ); - - if( ( V1.p[0] & 1 ) != 0 || ( V2.p[0] & 1 ) != 0 ) - { - MPI_CHK( esp_mpi_add_mpi( &V1, &V1, &TB ) ); - MPI_CHK( esp_mpi_sub_mpi( &V2, &V2, &TA ) ); - } - - MPI_CHK( esp_mpi_shift_r( &V1, 1 ) ); - MPI_CHK( esp_mpi_shift_r( &V2, 1 ) ); - } - - if( esp_mpi_cmp_mpi( &TU, &TV ) >= 0 ) - { - MPI_CHK( esp_mpi_sub_mpi( &TU, &TU, &TV ) ); - MPI_CHK( esp_mpi_sub_mpi( &U1, &U1, &V1 ) ); - MPI_CHK( esp_mpi_sub_mpi( &U2, &U2, &V2 ) ); - } - else - { - MPI_CHK( esp_mpi_sub_mpi( &TV, &TV, &TU ) ); - MPI_CHK( esp_mpi_sub_mpi( &V1, &V1, &U1 ) ); - MPI_CHK( esp_mpi_sub_mpi( &V2, &V2, &U2 ) ); - } - } - while( esp_mpi_cmp_int( &TU, 0 ) != 0 ); - - while( esp_mpi_cmp_int( &V1, 0 ) < 0 ) - MPI_CHK( esp_mpi_add_mpi( &V1, &V1, N ) ); - - while( esp_mpi_cmp_mpi( &V1, N ) >= 0 ) - MPI_CHK( esp_mpi_sub_mpi( &V1, &V1, N ) ); - - MPI_CHK( esp_mpi_copy( X, &V1 ) ); - -cleanup: - - esp_mpi_free( &TA ); esp_mpi_free( &TU ); esp_mpi_free( &U1 ); esp_mpi_free( &U2 ); - esp_mpi_free( &G ); esp_mpi_free( &TB ); esp_mpi_free( &TV ); - esp_mpi_free( &V1 ); esp_mpi_free( &V2 ); - - return( ret ); -} - -static const int small_prime[] = -{ - 3, 5, 7, 11, 13, 17, 19, 23, - 29, 31, 37, 41, 43, 47, 53, 59, - 61, 67, 71, 73, 79, 83, 89, 97, - 101, 103, 107, 109, 113, 127, 131, 137, - 139, 149, 151, 157, 163, 167, 173, 179, - 181, 191, 193, 197, 199, 211, 223, 227, - 229, 233, 239, 241, 251, 257, 263, 269, - 271, 277, 281, 283, 293, 307, 311, 313, - 317, 331, 337, 347, 349, 353, 359, 367, - 373, 379, 383, 389, 397, 401, 409, 419, - 421, 431, 433, 439, 443, 449, 457, 461, - 463, 467, 479, 487, 491, 499, 503, 509, - 521, 523, 541, 547, 557, 563, 569, 571, - 577, 587, 593, 599, 601, 607, 613, 617, - 619, 631, 641, 643, 647, 653, 659, 661, - 673, 677, 683, 691, 701, 709, 719, 727, - 733, 739, 743, 751, 757, 761, 769, 773, - 787, 797, 809, 811, 821, 823, 827, 829, - 839, 853, 857, 859, 863, 877, 881, 883, - 887, 907, 911, 919, 929, 937, 941, 947, - 953, 967, 971, 977, 983, 991, 997, -103 -}; - -/* - * Small divisors test (X must be positive) - * - * Return values: - * 0: no small factor (possible prime, more tests needed) - * 1: certain prime - * ERR_MPI_NOT_ACCEPTABLE: certain non-prime - * other negative: error - */ -static int esp_mpi_check_small_factors( const mpi *X ) -{ - int ret = 0; - size_t i; - esp_mpi_uint r; - - if( ( X->p[0] & 1 ) == 0 ) - return( ERR_MPI_NOT_ACCEPTABLE ); - - for( i = 0; small_prime[i] > 0; i++ ) - { - if( esp_mpi_cmp_int( X, small_prime[i] ) <= 0 ) - return( 1 ); - - MPI_CHK( esp_mpi_mod_int( &r, X, small_prime[i] ) ); - - if( r == 0 ) - return( ERR_MPI_NOT_ACCEPTABLE ); - } - -cleanup: - return( ret ); -} - -/* - * Miller-Rabin pseudo-primality test (HAC 4.24) - */ -static int esp_mpi_miller_rabin( const mpi *X, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng ) -{ - int ret, count; - size_t i, j, k, n, s; - mpi W, R, T, A, RR; - - esp_mpi_init( &W ); esp_mpi_init( &R ); esp_mpi_init( &T ); esp_mpi_init( &A ); - esp_mpi_init( &RR ); - - /* - * W = |X| - 1 - * R = W >> lsb( W ) - */ - MPI_CHK( esp_mpi_sub_int( &W, X, 1 ) ); - s = esp_mpi_lsb( &W ); - MPI_CHK( esp_mpi_copy( &R, &W ) ); - MPI_CHK( esp_mpi_shift_r( &R, s ) ); - - i = esp_mpi_bitlen( X ); - /* - * HAC, table 4.4 - */ - n = ( ( i >= 1300 ) ? 2 : ( i >= 850 ) ? 3 : - ( i >= 650 ) ? 4 : ( i >= 350 ) ? 8 : - ( i >= 250 ) ? 12 : ( i >= 150 ) ? 18 : 27 ); - - for( i = 0; i < n; i++ ) - { - /* - * pick a random A, 1 < A < |X| - 1 - */ - MPI_CHK( esp_mpi_fill_random( &A, X->n * ciL, f_rng, p_rng ) ); - - if( esp_mpi_cmp_mpi( &A, &W ) >= 0 ) - { - j = esp_mpi_bitlen( &A ) - esp_mpi_bitlen( &W ); - MPI_CHK( esp_mpi_shift_r( &A, j + 1 ) ); - } - A.p[0] |= 3; - - count = 0; - do { - MPI_CHK( esp_mpi_fill_random( &A, X->n * ciL, f_rng, p_rng ) ); - - j = esp_mpi_bitlen( &A ); - k = esp_mpi_bitlen( &W ); - if (j > k) { - MPI_CHK( esp_mpi_shift_r( &A, j - k ) ); - } - - if (count++ > 30) { - return ERR_MPI_NOT_ACCEPTABLE; - } - - } while ( esp_mpi_cmp_mpi( &A, &W ) >= 0 || - esp_mpi_cmp_int( &A, 1 ) <= 0 ); - - /* - * A = A^R mod |X| - */ - MPI_CHK( esp_mpi_exp_mod( &A, &A, &R, X, &RR ) ); - - if( esp_mpi_cmp_mpi( &A, &W ) == 0 || - esp_mpi_cmp_int( &A, 1 ) == 0 ) - continue; - - j = 1; - while( j < s && esp_mpi_cmp_mpi( &A, &W ) != 0 ) - { - /* - * A = A * A mod |X| - */ - MPI_CHK( esp_mpi_mul_mpi( &T, &A, &A ) ); - MPI_CHK( esp_mpi_mod_mpi( &A, &T, X ) ); - - if( esp_mpi_cmp_int( &A, 1 ) == 0 ) - break; - - j++; - } - - /* - * not prime if A != |X| - 1 or A == 1 - */ - if( esp_mpi_cmp_mpi( &A, &W ) != 0 || - esp_mpi_cmp_int( &A, 1 ) == 0 ) - { - ret = ERR_MPI_NOT_ACCEPTABLE; - break; - } - } - -cleanup: - esp_mpi_free( &W ); esp_mpi_free( &R ); esp_mpi_free( &T ); esp_mpi_free( &A ); - esp_mpi_free( &RR ); - - return( ret ); -} - -/* - * Pseudo-primality test: small factors, then Miller-Rabin - */ -int esp_mpi_is_prime( const mpi *X, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng ) -{ - int ret; - mpi XX; - - XX.s = 1; - XX.n = X->n; - XX.p = X->p; - - if( esp_mpi_cmp_int( &XX, 0 ) == 0 || - esp_mpi_cmp_int( &XX, 1 ) == 0 ) - return( ERR_MPI_NOT_ACCEPTABLE ); - - if( esp_mpi_cmp_int( &XX, 2 ) == 0 ) - return( 0 ); - - if( ( ret = esp_mpi_check_small_factors( &XX ) ) != 0 ) - { - if( ret == 1 ) - return( 0 ); - - return( ret ); - } - - return( esp_mpi_miller_rabin( &XX, f_rng, p_rng ) ); -} - -/* - * Prime number generation - */ -int esp_mpi_gen_prime( mpi *X, size_t nbits, int dh_flag, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng ) -{ - int ret; - size_t k, n; - esp_mpi_uint r; - mpi Y; - - if( nbits < 3 || nbits > MPI_MAX_BITS ) - return( ERR_MPI_BAD_INPUT_DATA ); - - esp_mpi_init( &Y ); - - n = BITS_TO_LIMBS( nbits ); - - MPI_CHK( esp_mpi_fill_random( X, n * ciL, f_rng, p_rng ) ); - - k = esp_mpi_bitlen( X ); - if( k > nbits ) MPI_CHK( esp_mpi_shift_r( X, k - nbits + 1 ) ); - - esp_mpi_set_bit( X, nbits-1, 1 ); - - X->p[0] |= 1; - - if( dh_flag == 0 ) - { - while( ( ret = esp_mpi_is_prime( X, f_rng, p_rng ) ) != 0 ) - { - if( ret != ERR_MPI_NOT_ACCEPTABLE ) - goto cleanup; - - MPI_CHK( esp_mpi_add_int( X, X, 2 ) ); - } - } - else - { - /* - * An necessary condition for Y and X = 2Y + 1 to be prime - * is X = 2 mod 3 (which is equivalent to Y = 2 mod 3). - * Make sure it is satisfied, while keeping X = 3 mod 4 - */ - - X->p[0] |= 2; - - MPI_CHK( esp_mpi_mod_int( &r, X, 3 ) ); - if( r == 0 ) - MPI_CHK( esp_mpi_add_int( X, X, 8 ) ); - else if( r == 1 ) - MPI_CHK( esp_mpi_add_int( X, X, 4 ) ); - - /* Set Y = (X-1) / 2, which is X / 2 because X is odd */ - MPI_CHK( esp_mpi_copy( &Y, X ) ); - MPI_CHK( esp_mpi_shift_r( &Y, 1 ) ); - - while( 1 ) - { - /* - * First, check small factors for X and Y - * before doing Miller-Rabin on any of them - */ - if( ( ret = esp_mpi_check_small_factors( X ) ) == 0 && - ( ret = esp_mpi_check_small_factors( &Y ) ) == 0 && - ( ret = esp_mpi_miller_rabin( X, f_rng, p_rng ) ) == 0 && - ( ret = esp_mpi_miller_rabin( &Y, f_rng, p_rng ) ) == 0 ) - { - break; - } - - if( ret != ERR_MPI_NOT_ACCEPTABLE ) - goto cleanup; - - /* - * Next candidates. We want to preserve Y = (X-1) / 2 and - * Y = 1 mod 2 and Y = 2 mod 3 (eq X = 3 mod 4 and X = 2 mod 3) - * so up Y by 6 and X by 12. - */ - MPI_CHK( esp_mpi_add_int( X, X, 12 ) ); - MPI_CHK( esp_mpi_add_int( &Y, &Y, 6 ) ); - } - } - -cleanup: - - esp_mpi_free( &Y ); - - return( ret ); -} - diff --git a/components/esp32/include/hwcrypto/bignum.h b/components/esp32/include/hwcrypto/bignum.h deleted file mode 100644 index dbcef43de..000000000 --- a/components/esp32/include/hwcrypto/bignum.h +++ /dev/null @@ -1,727 +0,0 @@ -/** - * \file bignum_alt.h - * - * \brief Multi-precision integer library, ESP32 hardware accelerated version - * Based on mbedTLS version. - * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved - * Additions Copyright (C) 2016, Espressif Systems (Shanghai) PTE Ltd - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -#ifndef _ESP_BIGNUM_H -#define _ESP_BIGNUM_H - -#include "esp_types.h" - - -#define MPI_DEBUG_ALT - - -#define ERR_MPI_FILE_IO_ERROR -0x0002 /**< An error occurred while reading from or writing to a file. */ -#define ERR_MPI_BAD_INPUT_DATA -0x0004 /**< Bad input parameters to function. */ -#define ERR_MPI_INVALID_CHARACTER -0x0006 /**< There is an invalid character in the digit string. */ -#define ERR_MPI_BUFFER_TOO_SMALL -0x0008 /**< The buffer is too small to write to. */ -#define ERR_MPI_NEGATIVE_VALUE -0x000A /**< The input arguments are negative or result in illegal output. */ -#define ERR_MPI_DIVISION_BY_ZERO -0x000C /**< The input argument for division is zero, which is not allowed. */ -#define ERR_MPI_NOT_ACCEPTABLE -0x000E /**< The input arguments are not acceptable. */ -#define ERR_MPI_ALLOC_FAILED -0x0010 /**< Memory allocation failed. */ - -#define MPI_CHK(f) do { if( ( ret = f ) != 0 ) goto cleanup; } while( 0 ) -#if defined(MPI_DEBUG_ALT) -#define esp_mpi_printf ets_printf -#else -#define esp_mpi_printf -#endif -/* - * Maximum size MPIs are allowed to grow to in number of limbs. - */ -#define MPI_MAX_LIMBS 10000 - -#if !defined(MPI_WINDOW_SIZE) -/* - * Maximum window size used for modular exponentiation. Default: 6 - * Minimum value: 1. Maximum value: 6. - * - * Result is an array of ( 2 << MPI_WINDOW_SIZE ) MPIs used - * for the sliding window calculation. (So 64 by default) - * - * Reduction in size, reduces speed. - */ -#define MPI_WINDOW_SIZE 6 /**< Maximum windows size used. */ -#endif /* !MPI_WINDOW_SIZE */ - -#if !defined(MPI_MAX_SIZE) -/* - * Maximum size of MPIs allowed in bits and bytes for user-MPIs. - * ( Default: 512 bytes => 4096 bits, Maximum tested: 2048 bytes => 16384 bits ) - * - * Note: Calculations can results temporarily in larger MPIs. So the number - * of limbs required (MPI_MAX_LIMBS) is higher. - */ -#define MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */ -#endif /* !MPI_MAX_SIZE */ - -#define MPI_MAX_BITS ( 8 * MPI_MAX_SIZE ) /**< Maximum number of bits for usable MPIs. */ - -/* - * When reading from files with esp_mpi_read_file() and writing to files with - * esp_mpi_write_file() the buffer should have space - * for a (short) label, the MPI (in the provided radix), the newline - * characters and the '\0'. - * - * By default we assume at least a 10 char label, a minimum radix of 10 - * (decimal) and a maximum of 4096 bit numbers (1234 decimal chars). - * Autosized at compile time for at least a 10 char label, a minimum radix - * of 10 (decimal) for a number of MPI_MAX_BITS size. - * - * This used to be statically sized to 1250 for a maximum of 4096 bit - * numbers (1234 decimal chars). - * - * Calculate using the formula: - * MPI_RW_BUFFER_SIZE = ceil(MPI_MAX_BITS / ln(10) * ln(2)) + - * LabelSize + 6 - */ -#define MPI_MAX_BITS_SCALE100 ( 100 * MPI_MAX_BITS ) -#define LN_2_DIV_LN_10_SCALE100 332 -#define MPI_RW_BUFFER_SIZE ( ((MPI_MAX_BITS_SCALE100 + LN_2_DIV_LN_10_SCALE100 - 1) / LN_2_DIV_LN_10_SCALE100) + 10 + 6 ) - -/* - * Define the base integer type, architecture-wise. - * - * 32-bit integers can be forced on 64-bit arches (eg. for testing purposes) - * by defining HAVE_INT32 and undefining HAVE_ASM - */ -#if ( ! defined(HAVE_INT32) && \ - defined(_MSC_VER) && defined(_M_AMD64) ) - #define HAVE_INT64 - typedef int64_t esp_mpi_sint; - typedef uint64_t esp_mpi_uint; -#else - #if ( ! defined(HAVE_INT32) && \ - defined(__GNUC__) && ( \ - defined(__amd64__) || defined(__x86_64__) || \ - defined(__ppc64__) || defined(__powerpc64__) || \ - defined(__ia64__) || defined(__alpha__) || \ - (defined(__sparc__) && defined(__arch64__)) || \ - defined(__s390x__) || defined(__mips64) ) ) - #define HAVE_INT64 - typedef int64_t esp_mpi_sint; - typedef uint64_t esp_mpi_uint; - /* t_udbl defined as 128-bit unsigned int */ - typedef unsigned int t_udbl __attribute__((mode(TI))); - #define HAVE_UDBL - #else - #define HAVE_INT32 - typedef int32_t esp_mpi_sint; - typedef uint32_t esp_mpi_uint; - typedef uint64_t t_udbl; - #define HAVE_UDBL - #endif /* !HAVE_INT32 && __GNUC__ && 64-bit platform */ -#endif /* !HAVE_INT32 && _MSC_VER && _M_AMD64 */ - -#ifdef __cplusplus -extern "C" { -#endif - -/** - * \brief MPI structure - */ -typedef struct -{ - int s; /*!< integer sign */ - size_t n; /*!< total # of limbs */ - esp_mpi_uint *p; /*!< pointer to limbs */ -}mpi, MPI_CTX; - -/** - * \brief Lock access to MPI hardware unit - * - * MPI hardware unit can only be used by one - * consumer at a time. - * - * esp_mpi_xxx API calls automatically manage locking & unlocking of - * hardware, this function is only needed if you want to call - * ets_bigint_xxx functions directly. - */ -void esp_mpi_acquire_hardware( void ); - -/** - * \brief Unlock access to MPI hardware unit - * - * esp_mpi_xxx API calls automatically manage locking & unlocking of - * hardware, this function is only needed if you want to call - * ets_bigint_xxx functions directly. - */ -void esp_mpi_release_hardware( void ); - -/** - * \brief Initialize one MPI (make internal references valid) - * This just makes it ready to be set or freed, - * but does not define a value for the MPI. - * - * \param X One MPI to initialize. - */ -void esp_mpi_init( mpi *X ); - -/** - * \brief Unallocate one MPI - * - * \param X One MPI to unallocate. - */ -void esp_mpi_free( mpi *X ); - -/** - * \brief Enlarge to the specified number of limbs - * - * \param X MPI to grow - * \param nblimbs The target number of limbs - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_grow( mpi *X, size_t nblimbs ); - -/** - * \brief Resize down, keeping at least the specified number of limbs - * - * \param X MPI to shrink - * \param nblimbs The minimum number of limbs to keep - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_shrink( mpi *X, size_t nblimbs ); - -/** - * \brief Copy the contents of Y into X - * - * \param X Destination MPI - * \param Y Source MPI - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_copy( mpi *X, const mpi *Y ); - -/** - * \brief Swap the contents of X and Y - * - * \param X First MPI value - * \param Y Second MPI value - */ -void esp_mpi_swap( mpi *X, mpi *Y ); - -/** - * \brief Safe conditional assignement X = Y if assign is 1 - * - * \param X MPI to conditionally assign to - * \param Y Value to be assigned - * \param assign 1: perform the assignment, 0: keep X's original value - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed, - * - * \note This function is equivalent to - * if( assign ) esp_mpi_copy( X, Y ); - * except that it avoids leaking any information about whether - * the assignment was done or not (the above code may leak - * information through branch prediction and/or memory access - * patterns analysis). - */ -int esp_mpi_safe_cond_assign( mpi *X, const mpi *Y, unsigned char assign ); - -/** - * \brief Safe conditional swap X <-> Y if swap is 1 - * - * \param X First mpi value - * \param Y Second mpi value - * \param assign 1: perform the swap, 0: keep X and Y's original values - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed, - * - * \note This function is equivalent to - * if( assign ) esp_mpi_swap( X, Y ); - * except that it avoids leaking any information about whether - * the assignment was done or not (the above code may leak - * information through branch prediction and/or memory access - * patterns analysis). - */ -int esp_mpi_safe_cond_swap( mpi *X, mpi *Y, unsigned char assign ); - -/** - * \brief Set value from integer - * - * \param X MPI to set - * \param z Value to use - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_lset( mpi *X, esp_mpi_sint z ); - -/** - * \brief Get a specific bit from X - * - * \param X MPI to use - * \param pos Zero-based index of the bit in X - * - * \return Either a 0 or a 1 - */ -int esp_mpi_get_bit( const mpi *X, size_t pos ); - -/** - * \brief Set a bit of X to a specific value of 0 or 1 - * - * \note Will grow X if necessary to set a bit to 1 in a not yet - * existing limb. Will not grow if bit should be set to 0 - * - * \param X MPI to use - * \param pos Zero-based index of the bit in X - * \param val The value to set the bit to (0 or 1) - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed, - * ERR_MPI_BAD_INPUT_DATA if val is not 0 or 1 - */ -int esp_mpi_set_bit( mpi *X, size_t pos, unsigned char val ); - -/** - * \brief Return the number of zero-bits before the least significant - * '1' bit - * - * Note: Thus also the zero-based index of the least significant '1' bit - * - * \param X MPI to use - */ -size_t esp_mpi_lsb( const mpi *X ); - -/** - * \brief Return the number of bits up to and including the most - * significant '1' bit' - * - * Note: Thus also the one-based index of the most significant '1' bit - * - * \param X MPI to use - */ -size_t esp_mpi_bitlen( const mpi *X ); - -/** - * \brief Return the total size in bytes - * - * \param X MPI to use - */ -size_t esp_mpi_size( const mpi *X ); - -/** - * \brief Import from an ASCII string - * - * \param X Destination MPI - * \param radix Input numeric base - * \param s Null-terminated string buffer - * - * \return 0 if successful, or a ERR_MPI_XXX error code - */ -int esp_mpi_read_string( mpi *X, int radix, const char *s ); - -/** - * \brief Export into an ASCII string - * - * \param X Source MPI - * \param radix Output numeric base - * \param buf Buffer to write the string to - * \param buflen Length of buf - * \param olen Length of the string written, including final NUL byte - * - * \return 0 if successful, or a ERR_MPI_XXX error code. - * *olen is always updated to reflect the amount - * of data that has (or would have) been written. - * - * \note Call this function with buflen = 0 to obtain the - * minimum required buffer size in *olen. - */ -int esp_mpi_write_string( const mpi *X, int radix, - char *buf, size_t buflen, size_t *olen ); - -#if defined(FS_IO) -/** - * \brief Read X from an opened file - * - * \param X Destination MPI - * \param radix Input numeric base - * \param fin Input file handle - * - * \return 0 if successful, ERR_MPI_BUFFER_TOO_SMALL if - * the file read buffer is too small or a - * ERR_MPI_XXX error code - */ -int esp_mpi_read_file( mpi *X, int radix, FILE *fin ); - -/** - * \brief Write X into an opened file, or stdout if fout is NULL - * - * \param p Prefix, can be NULL - * \param X Source MPI - * \param radix Output numeric base - * \param fout Output file handle (can be NULL) - * - * \return 0 if successful, or a ERR_MPI_XXX error code - * - * \note Set fout == NULL to print X on the console. - */ -int esp_mpi_write_file( const char *p, const mpi *X, int radix, FILE *fout ); -#endif /* FS_IO */ - -/** - * \brief Import X from unsigned binary data, big endian - * - * \param X Destination MPI - * \param buf Input buffer - * \param buflen Input buffer size - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_read_binary( mpi *X, const unsigned char *buf, size_t buflen ); - -/** - * \brief Export X into unsigned binary data, big endian. - * Always fills the whole buffer, which will start with zeros - * if the number is smaller. - * - * \param X Source MPI - * \param buf Output buffer - * \param buflen Output buffer size - * - * \return 0 if successful, - * ERR_MPI_BUFFER_TOO_SMALL if buf isn't large enough - */ -int esp_mpi_write_binary( const mpi *X, unsigned char *buf, size_t buflen ); - -/** - * \brief Left-shift: X <<= count - * - * \param X MPI to shift - * \param count Amount to shift - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_shift_l( mpi *X, size_t count ); - -/** - * \brief Right-shift: X >>= count - * - * \param X MPI to shift - * \param count Amount to shift - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_shift_r( mpi *X, size_t count ); - -/** - * \brief Compare unsigned values - * - * \param X Left-hand MPI - * \param Y Right-hand MPI - * - * \return 1 if |X| is greater than |Y|, - * -1 if |X| is lesser than |Y| or - * 0 if |X| is equal to |Y| - */ -int esp_mpi_cmp_abs( const mpi *X, const mpi *Y ); - -/** - * \brief Compare signed values - * - * \param X Left-hand MPI - * \param Y Right-hand MPI - * - * \return 1 if X is greater than Y, - * -1 if X is lesser than Y or - * 0 if X is equal to Y - */ -int esp_mpi_cmp_mpi( const mpi *X, const mpi *Y ); - -/** - * \brief Compare signed values - * - * \param X Left-hand MPI - * \param z The integer value to compare to - * - * \return 1 if X is greater than z, - * -1 if X is lesser than z or - * 0 if X is equal to z - */ -int esp_mpi_cmp_int( const mpi *X, esp_mpi_sint z ); - -/** - * \brief Unsigned addition: X = |A| + |B| - * - * \param X Destination MPI - * \param A Left-hand MPI - * \param B Right-hand MPI - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_add_abs( mpi *X, const mpi *A, const mpi *B ); - -/** - * \brief Unsigned subtraction: X = |A| - |B| - * - * \param X Destination MPI - * \param A Left-hand MPI - * \param B Right-hand MPI - * - * \return 0 if successful, - * ERR_MPI_NEGATIVE_VALUE if B is greater than A - */ -int esp_mpi_sub_abs( mpi *X, const mpi *A, const mpi *B ); - -/** - * \brief Signed addition: X = A + B - * - * \param X Destination MPI - * \param A Left-hand MPI - * \param B Right-hand MPI - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_add_mpi( mpi *X, const mpi *A, const mpi *B ); - -/** - * \brief Signed subtraction: X = A - B - * - * \param X Destination MPI - * \param A Left-hand MPI - * \param B Right-hand MPI - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_sub_mpi( mpi *X, const mpi *A, const mpi *B ); - -/** - * \brief Signed addition: X = A + b - * - * \param X Destination MPI - * \param A Left-hand MPI - * \param b The integer value to add - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_add_int( mpi *X, const mpi *A, esp_mpi_sint b ); - -/** - * \brief Signed subtraction: X = A - b - * - * \param X Destination MPI - * \param A Left-hand MPI - * \param b The integer value to subtract - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_sub_int( mpi *X, const mpi *A, esp_mpi_sint b ); - -/** - * \brief Baseline multiplication: X = A * B - * - * \param X Destination MPI - * \param A Left-hand MPI - * \param B Right-hand MPI - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_mul_mpi( mpi *X, const mpi *A, const mpi *B ); - -/** - * \brief Baseline multiplication: X = A * b - * - * \param X Destination MPI - * \param A Left-hand MPI - * \param b The unsigned integer value to multiply with - * - * \note b is unsigned - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_mul_int( mpi *X, const mpi *A, esp_mpi_uint b ); - -/** - * \brief Division by mpi: A = Q * B + R - * - * \param Q Destination MPI for the quotient - * \param R Destination MPI for the rest value - * \param A Left-hand MPI - * \param B Right-hand MPI - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed, - * ERR_MPI_DIVISION_BY_ZERO if B == 0 - * - * \note Either Q or R can be NULL. - */ -int esp_mpi_div_mpi( mpi *Q, mpi *R, const mpi *A, const mpi *B ); - -/** - * \brief Division by int: A = Q * b + R - * - * \param Q Destination MPI for the quotient - * \param R Destination MPI for the rest value - * \param A Left-hand MPI - * \param b Integer to divide by - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed, - * ERR_MPI_DIVISION_BY_ZERO if b == 0 - * - * \note Either Q or R can be NULL. - */ -int esp_mpi_div_int( mpi *Q, mpi *R, const mpi *A, esp_mpi_sint b ); - -/** - * \brief Modulo: R = A mod B - * - * \param R Destination MPI for the rest value - * \param A Left-hand MPI - * \param B Right-hand MPI - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed, - * ERR_MPI_DIVISION_BY_ZERO if B == 0, - * ERR_MPI_NEGATIVE_VALUE if B < 0 - */ -int esp_mpi_mod_mpi( mpi *R, const mpi *A, const mpi *B ); - -/** - * \brief Modulo: r = A mod b - * - * \param r Destination esp_mpi_uint - * \param A Left-hand MPI - * \param b Integer to divide by - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed, - * ERR_MPI_DIVISION_BY_ZERO if b == 0, - * ERR_MPI_NEGATIVE_VALUE if b < 0 - */ -int esp_mpi_mod_int( esp_mpi_uint *r, const mpi *A, esp_mpi_sint b ); - -/** - * \brief Sliding-window exponentiation: X = A^E mod N - * - * \param X Destination MPI - * \param A Left-hand MPI - * \param E Exponent MPI - * \param N Modular MPI - * \param _RR Speed-up MPI used for recalculations - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed, - * ERR_MPI_BAD_INPUT_DATA if N is negative or even or - * if E is negative - * - * \note _RR is used to avoid re-computing R*R mod N across - * multiple calls, which speeds up things a bit. It can - * be set to NULL if the extra performance is unneeded. - */ -int esp_mpi_exp_mod( mpi *X, const mpi *A, const mpi *E, const mpi *N, mpi *_RR ); - -/** - * \brief Fill an MPI X with size bytes of random - * - * \param X Destination MPI - * \param size Size in bytes - * \param f_rng RNG function - * \param p_rng RNG parameter - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_fill_random( mpi *X, size_t size, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng ); - -/** - * \brief Greatest common divisor: G = gcd(A, B) - * - * \param G Destination MPI - * \param A Left-hand MPI - * \param B Right-hand MPI - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed - */ -int esp_mpi_gcd( mpi *G, const mpi *A, const mpi *B ); - -/** - * \brief Modular inverse: X = A^-1 mod N - * - * \param X Destination MPI - * \param A Left-hand MPI - * \param N Right-hand MPI - * - * \return 0 if successful, - * ERR_MPI_ALLOC_FAILED if memory allocation failed, - * ERR_MPI_BAD_INPUT_DATA if N is negative or nil - ERR_MPI_NOT_ACCEPTABLE if A has no inverse mod N - */ -int esp_mpi_inv_mod( mpi *X, const mpi *A, const mpi *N ); - -/** - * \brief Miller-Rabin primality test - * - * \param X MPI to check - * \param f_rng RNG function - * \param p_rng RNG parameter - * - * \return 0 if successful (probably prime), - * ERR_MPI_ALLOC_FAILED if memory allocation failed, - * ERR_MPI_NOT_ACCEPTABLE if X is not prime - */ -int esp_mpi_is_prime( const mpi *X, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng ); - -/** - * \brief Prime number generation - * - * \param X Destination MPI - * \param nbits Required size of X in bits - * ( 3 <= nbits <= MPI_MAX_BITS ) - * \param dh_flag If 1, then (X-1)/2 will be prime too - * \param f_rng RNG function - * \param p_rng RNG parameter - * - * \return 0 if successful (probably prime), - * ERR_MPI_ALLOC_FAILED if memory allocation failed, - * ERR_MPI_BAD_INPUT_DATA if nbits is < 3 - */ -int esp_mpi_gen_prime( mpi *X, size_t nbits, int dh_flag, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng ); - - -#endif - diff --git a/components/mbedtls/Makefile b/components/mbedtls/Makefile index e44ce2b53..cb3ee2c56 100644 --- a/components/mbedtls/Makefile +++ b/components/mbedtls/Makefile @@ -1,5 +1,8 @@ # # Component Makefile +# + +COMPONENT_ADD_INCLUDEDIRS := port/include include COMPONENT_SRCDIRS := library port diff --git a/components/mbedtls/include/mbedtls/esp_config.h b/components/mbedtls/include/mbedtls/esp_config.h index 0bf7e14d1..6d52294b7 100644 --- a/components/mbedtls/include/mbedtls/esp_config.h +++ b/components/mbedtls/include/mbedtls/esp_config.h @@ -225,7 +225,6 @@ * Uncomment a macro to enable alternate implementation of the corresponding * module. */ -//#define MBEDTLS_AES_ALT //#define MBEDTLS_ARC4_ALT //#define MBEDTLS_BLOWFISH_ALT //#define MBEDTLS_CAMELLIA_ALT @@ -235,11 +234,22 @@ //#define MBEDTLS_MD4_ALT //#define MBEDTLS_MD5_ALT //#define MBEDTLS_RIPEMD160_ALT -//#define MBEDTLS_SHA1_ALT -//#define MBEDTLS_SHA256_ALT -//#define MBEDTLS_SHA512_ALT -//#define MBEDTLS_BIGNUM_ALT +/* The following units have ESP32 hardware support, + uncommenting each _ALT macro will use the + hardware-accelerated implementation. */ +#define MBEDTLS_AES_ALT +#define MBEDTLS_SHA1_ALT +#define MBEDTLS_SHA256_ALT +#define MBEDTLS_SHA512_ALT + +/* The following MPI (bignum) functions have ESP32 hardware support, + Uncommenting these macros will use the hardware-accelerated + implementations. +*/ +#define MBEDTLS_MPI_EXP_MOD_ALT +#define MBEDTLS_MPI_MUL_MPI_ALT + /** * \def MBEDTLS_MD2_PROCESS_ALT * diff --git a/components/mbedtls/library/bignum.c b/components/mbedtls/library/bignum.c index e438fdddb..e739bc1d3 100644 --- a/components/mbedtls/library/bignum.c +++ b/components/mbedtls/library/bignum.c @@ -1164,6 +1164,7 @@ void mpi_mul_hlp( size_t i, mbedtls_mpi_uint *s, mbedtls_mpi_uint *d, mbedtls_mp while( c != 0 ); } +#if !defined(MBEDTLS_MPI_MUL_MPI_ALT) /* * Baseline multiplication: X = A * B (HAC 14.12) */ @@ -1200,6 +1201,7 @@ cleanup: return( ret ); } +#endif /* * Baseline multiplication: X = A * b @@ -1598,6 +1600,7 @@ static int mpi_montred( mbedtls_mpi *A, const mbedtls_mpi *N, mbedtls_mpi_uint m return( mpi_montmul( A, &U, N, mm, T ) ); } +#if !defined(MBEDTLS_MPI_EXP_MOD_ALT) /* * Sliding-window exponentiation: X = A^E mod N (HAC 14.85) */ @@ -1805,6 +1808,7 @@ cleanup: return( ret ); } +#endif /* * Greatest common divisor: G = gcd(A, B) (HAC 14.54) diff --git a/components/mbedtls/port/esp_bignum.c b/components/mbedtls/port/esp_bignum.c new file mode 100644 index 000000000..59bdc8726 --- /dev/null +++ b/components/mbedtls/port/esp_bignum.c @@ -0,0 +1,536 @@ +/** + * \brief Multi-precision integer library, ESP32 hardware accelerated parts + * + * based on mbedTLS implementation + * + * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved + * Additions Copyright (C) 2016, Espressif Systems (Shanghai) PTE Ltd + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ +#include +#include +#include +#include "mbedtls/bignum.h" +#include "mbedtls/bn_mul.h" +#include "rom/bigint.h" + +#if defined(MBEDTLS_MPI_MUL_MPI_ALT) || defined(MBEDTLS_MPI_EXP_MOD_ALT) + +/* Constants from mbedTLS bignum.c */ +#define ciL (sizeof(mbedtls_mpi_uint)) /* chars in limb */ +#define biL (ciL << 3) /* bits in limb */ + +static _lock_t mpi_lock; + +/* At the moment these hardware locking functions aren't exposed publically + for MPI. If you want to use the ROM bigint functions and co-exist with mbedTLS, + please raise a feature request. +*/ +static void esp_mpi_acquire_hardware( void ) +{ + /* newlib locks lazy initialize on ESP-IDF */ + _lock_acquire(&mpi_lock); + ets_bigint_enable(); +} + +static void esp_mpi_release_hardware( void ) +{ + ets_bigint_disable(); + _lock_release(&mpi_lock); +} + +/* + * Helper for mbedtls_mpi multiplication + * copied/trimmed from mbedtls bignum.c + */ +static void mpi_mul_hlp( size_t i, mbedtls_mpi_uint *s, mbedtls_mpi_uint *d, mbedtls_mpi_uint b ) +{ + mbedtls_mpi_uint c = 0, t = 0; + + for( ; i >= 16; i -= 16 ) + { + MULADDC_INIT + MULADDC_CORE MULADDC_CORE + MULADDC_CORE MULADDC_CORE + MULADDC_CORE MULADDC_CORE + MULADDC_CORE MULADDC_CORE + + MULADDC_CORE MULADDC_CORE + MULADDC_CORE MULADDC_CORE + MULADDC_CORE MULADDC_CORE + MULADDC_CORE MULADDC_CORE + MULADDC_STOP + } + + for( ; i >= 8; i -= 8 ) + { + MULADDC_INIT + MULADDC_CORE MULADDC_CORE + MULADDC_CORE MULADDC_CORE + + MULADDC_CORE MULADDC_CORE + MULADDC_CORE MULADDC_CORE + MULADDC_STOP + } + + + for( ; i > 0; i-- ) + { + MULADDC_INIT + MULADDC_CORE + MULADDC_STOP + } + + t++; + + do { + *d += c; c = ( *d < c ); d++; + } + while( c != 0 ); +} + + +/* + * Helper for mbedtls_mpi subtraction + * Copied/adapter from mbedTLS bignum.c + */ +static void mpi_sub_hlp( size_t n, mbedtls_mpi_uint *s, mbedtls_mpi_uint *d ) +{ + size_t i; + mbedtls_mpi_uint c, z; + + for( i = c = 0; i < n; i++, s++, d++ ) + { + z = ( *d < c ); *d -= c; + c = ( *d < *s ) + z; *d -= *s; + } + + while( c != 0 ) + { + z = ( *d < c ); *d -= c; + c = z; i++; d++; + } +} + + +/* The following 3 Montgomery arithmetic function are + copied from mbedTLS bigint.c verbatim as they are static. + + TODO: find a way to support making the versions in mbedtls + non-static. +*/ + +/* + * Fast Montgomery initialization (thanks to Tom St Denis) + */ +static void mpi_montg_init( mbedtls_mpi_uint *mm, const mbedtls_mpi *N ) +{ + mbedtls_mpi_uint x, m0 = N->p[0]; + unsigned int i; + + x = m0; + x += ( ( m0 + 2 ) & 4 ) << 1; + + for( i = biL; i >= 8; i /= 2 ) + x *= ( 2 - ( m0 * x ) ); + + *mm = ~x + 1; +} + +/* + * Montgomery multiplication: A = A * B * R^-1 mod N (HAC 14.36) + */ +static int mpi_montmul( mbedtls_mpi *A, const mbedtls_mpi *B, const mbedtls_mpi *N, mbedtls_mpi_uint mm, + const mbedtls_mpi *T ) +{ + size_t i, n, m; + mbedtls_mpi_uint u0, u1, *d; + + if( T->n < N->n + 1 || T->p == NULL ) + return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA ); + + memset( T->p, 0, T->n * ciL ); + + d = T->p; + n = N->n; + m = ( B->n < n ) ? B->n : n; + + for( i = 0; i < n; i++ ) + { + /* + * T = (T + u0*B + u1*N) / 2^biL + */ + u0 = A->p[i]; + u1 = ( d[0] + u0 * B->p[0] ) * mm; + + mpi_mul_hlp( m, B->p, d, u0 ); + mpi_mul_hlp( n, N->p, d, u1 ); + + *d++ = u0; d[n + 1] = 0; + } + + memcpy( A->p, d, ( n + 1 ) * ciL ); + + if( mbedtls_mpi_cmp_abs( A, N ) >= 0 ) + mpi_sub_hlp( n, N->p, A->p ); + else + /* prevent timing attacks */ + mpi_sub_hlp( n, A->p, T->p ); + + return( 0 ); +} + +/* + * Montgomery reduction: A = A * R^-1 mod N + */ +static int mpi_montred( mbedtls_mpi *A, const mbedtls_mpi *N, mbedtls_mpi_uint mm, const mbedtls_mpi *T ) +{ + mbedtls_mpi_uint z = 1; + mbedtls_mpi U; + + U.n = U.s = (int) z; + U.p = &z; + + return( mpi_montmul( A, &U, N, mm, T ) ); +} + + +/* Allocate parameters used by hardware MPI multiply, + and copy mbedtls_mpi structures into them */ +static int mul_pram_alloc(const mbedtls_mpi *A, const mbedtls_mpi *B, char **pA, char **pB, char **pX, size_t *bites) +{ + char *sa, *sb, *sx; +// int algn; + int words, bytes; + int abytes, bbytes; + + if (A->n > B->n) + words = A->n; + else + words = B->n; + + bytes = (words / 16 + ((words % 16) ? 1 : 0 )) * 16 * 4 * 2; + + abytes = A->n * 4; + bbytes = B->n * 4; + + sa = malloc(bytes); + if (!sa) { + return -1; + } + + sb = malloc(bytes); + if (!sb) { + free(sa); + return -1; + } + + sx = malloc(bytes); + if (!sx) { + free(sa); + free(sb); + return -1; + } + + memcpy(sa, A->p, abytes); + memset(sa + abytes, 0, bytes - abytes); + + memcpy(sb, B->p, bbytes); + memset(sb + bbytes, 0, bytes - bbytes); + + *pA = sa; + *pB = sb; + + *pX = sx; + + *bites = bytes * 4; + + return 0; +} + +#if defined(MBEDTLS_MPI_MUL_MPI_ALT) + +int mbedtls_mpi_mul_mpi( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi *B ) +{ + int ret = -1; + size_t i, j; + char *s1 = NULL, *s2 = NULL, *dest = NULL; + size_t bites; + + mbedtls_mpi TA, TB; + + mbedtls_mpi_init( &TA ); mbedtls_mpi_init( &TB ); + + if( X == A ) { MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &TA, A ) ); A = &TA; } + if( X == B ) { MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &TB, B ) ); B = &TB; } + + for( i = A->n; i > 0; i-- ) + if( A->p[i - 1] != 0 ) + break; + + for( j = B->n; j > 0; j-- ) + if( B->p[j - 1] != 0 ) + break; + + MBEDTLS_MPI_CHK( mbedtls_mpi_grow( X, i + j ) ); + MBEDTLS_MPI_CHK( mbedtls_mpi_lset( X, 0 ) ); + + if (mul_pram_alloc(A, B, &s1, &s2, &dest, &bites)) { + goto cleanup; + } + + esp_mpi_acquire_hardware(); + if (ets_bigint_mult_prepare((uint32_t *)s1, (uint32_t *)s2, bites)){ + ets_bigint_wait_finish(); + if (ets_bigint_mult_getz((uint32_t *)dest, bites) == true) { + memcpy(X->p, dest, (i + j) * 4); + ret = 0; + } else { + printf("ets_bigint_mult_getz failed\n"); + } + } else{ + printf("Baseline multiplication failed\n"); + } + esp_mpi_release_hardware(); + + X->s = A->s * B->s; + + free(s1); + free(s2); + free(dest); + +cleanup: + + mbedtls_mpi_free( &TB ); mbedtls_mpi_free( &TA ); + + return( ret ); +} + +#endif /* MBEDTLS_MPI_MUL_MPI_ALT */ + +#if defined(MBEDTLS_MPI_EXP_MOD_ALT) +/* + * Sliding-window exponentiation: X = A^E mod N (HAC 14.85) + */ +int mbedtls_mpi_exp_mod( mbedtls_mpi* X, const mbedtls_mpi* A, const mbedtls_mpi* E, const mbedtls_mpi* N, mbedtls_mpi* _RR ) +{ + int ret; + size_t wbits, wsize, one = 1; + size_t i, j, nblimbs; + size_t bufsize, nbits; + mbedtls_mpi_uint ei, mm, state; + mbedtls_mpi RR, T, W[ 2 << MBEDTLS_MPI_WINDOW_SIZE ], Apos; + int neg; + + if( mbedtls_mpi_cmp_int( N, 0 ) < 0 || ( N->p[0] & 1 ) == 0 ) + return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA ); + + if( mbedtls_mpi_cmp_int( E, 0 ) < 0 ) + return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA ); + + /* + * Init temps and window size + */ + mpi_montg_init( &mm, N ); + mbedtls_mpi_init( &RR ); mbedtls_mpi_init( &T ); + mbedtls_mpi_init( &Apos ); + memset( W, 0, sizeof( W ) ); + + i = mbedtls_mpi_bitlen( E ); + + wsize = ( i > 671 ) ? 6 : ( i > 239 ) ? 5 : + ( i > 79 ) ? 4 : ( i > 23 ) ? 3 : 1; + + if( wsize > MBEDTLS_MPI_WINDOW_SIZE ) + wsize = MBEDTLS_MPI_WINDOW_SIZE; + + j = N->n + 1; + MBEDTLS_MPI_CHK( mbedtls_mpi_grow( X, j ) ); + MBEDTLS_MPI_CHK( mbedtls_mpi_grow( &W[1], j ) ); + MBEDTLS_MPI_CHK( mbedtls_mpi_grow( &T, j * 2 ) ); + + /* + * Compensate for negative A (and correct at the end) + */ + neg = ( A->s == -1 ); + if( neg ) + { + MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &Apos, A ) ); + Apos.s = 1; + A = &Apos; + } + + /* + * If 1st call, pre-compute R^2 mod N + */ + if( _RR == NULL || _RR->p == NULL ) + { + MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &RR, 1 ) ); + MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &RR, N->n * 2 * biL ) ); + MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &RR, &RR, N ) ); + + if( _RR != NULL ) + memcpy( _RR, &RR, sizeof( mbedtls_mpi) ); + } + else + memcpy( &RR, _RR, sizeof( mbedtls_mpi) ); + + /* + * W[1] = A * R^2 * R^-1 mod N = A * R mod N + */ + if( mbedtls_mpi_cmp_mpi( A, N ) >= 0 ) + MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &W[1], A, N ) ); + else + MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &W[1], A ) ); + + mpi_montmul( &W[1], &RR, N, mm, &T ); + + /* + * X = R^2 * R^-1 mod N = R mod N + */ + MBEDTLS_MPI_CHK( mbedtls_mpi_copy( X, &RR ) ); + mpi_montred( X, N, mm, &T ); + + if( wsize > 1 ) + { + /* + * W[1 << (wsize - 1)] = W[1] ^ (wsize - 1) + */ + j = one << ( wsize - 1 ); + + MBEDTLS_MPI_CHK( mbedtls_mpi_grow( &W[j], N->n + 1 ) ); + MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &W[j], &W[1] ) ); + + for( i = 0; i < wsize - 1; i++ ) + mpi_montmul( &W[j], &W[j], N, mm, &T ); + + /* + * W[i] = W[i - 1] * W[1] + */ + for( i = j + 1; i < ( one << wsize ); i++ ) + { + MBEDTLS_MPI_CHK( mbedtls_mpi_grow( &W[i], N->n + 1 ) ); + MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &W[i], &W[i - 1] ) ); + + mpi_montmul( &W[i], &W[1], N, mm, &T ); + } + } + + nblimbs = E->n; + bufsize = 0; + nbits = 0; + wbits = 0; + state = 0; + + while( 1 ) + { + if( bufsize == 0 ) + { + if( nblimbs == 0 ) + break; + + nblimbs--; + + bufsize = sizeof( mbedtls_mpi_uint ) << 3; + } + + bufsize--; + + ei = (E->p[nblimbs] >> bufsize) & 1; + + /* + * skip leading 0s + */ + if( ei == 0 && state == 0 ) + continue; + + if( ei == 0 && state == 1 ) + { + /* + * out of window, square X + */ + mpi_montmul( X, X, N, mm, &T ); + continue; + } + + /* + * add ei to current window + */ + state = 2; + + nbits++; + wbits |= ( ei << ( wsize - nbits ) ); + + if( nbits == wsize ) + { + /* + * X = X^wsize R^-1 mod N + */ + for( i = 0; i < wsize; i++ ) + mpi_montmul( X, X, N, mm, &T ); + + /* + * X = X * W[wbits] R^-1 mod N + */ + mpi_montmul( X, &W[wbits], N, mm, &T ); + + state--; + nbits = 0; + wbits = 0; + } + } + + /* + * process the remaining bits + */ + for( i = 0; i < nbits; i++ ) + { + mpi_montmul( X, X, N, mm, &T ); + + wbits <<= 1; + + if( ( wbits & ( one << wsize ) ) != 0 ) + mpi_montmul( X, &W[1], N, mm, &T ); + } + + /* + * X = A^E * R * R^-1 mod N = A^E mod N + */ + mpi_montred( X, N, mm, &T ); + + if( neg ) + { + X->s = -1; + MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( X, N, X ) ); + } + +cleanup: + + for( i = ( one << ( wsize - 1 ) ); i < ( one << wsize ); i++ ) + mbedtls_mpi_free( &W[i] ); + + mbedtls_mpi_free( &W[1] ); mbedtls_mpi_free( &T ); mbedtls_mpi_free( &Apos ); + + if( _RR == NULL || _RR->p == NULL ) + mbedtls_mpi_free( &RR ); + + return( ret ); +} + +#endif /* MBEDTLS_MPI_EXP_MOD_ALT */ + +#endif /* MBEDTLS_MPI_MUL_MPI_ALT || MBEDTLS_MPI_EXP_MOD_ALT */ + diff --git a/components/mbedtls/port/esp_hardware.c b/components/mbedtls/port/esp_hardware.c index b83c4d7aa..915766249 100644 --- a/components/mbedtls/port/esp_hardware.c +++ b/components/mbedtls/port/esp_hardware.c @@ -9,34 +9,8 @@ #include #if defined(MBEDTLS_ENTROPY_HARDWARE_ALT) -/** - * \brief Entropy poll callback for a hardware source - * - * \warning This is not provided by mbed TLS! - * See \c MBEDTLS_ENTROPY_HARDWARE_ALT in config.h. - * - * \note This must accept NULL as its first argument. - */ -static int os_get_random(unsigned char *buf, size_t len) -{ - int i, j; - unsigned long tmp; - - for (i = 0; i < ((len + 3) & ~3) / 4; i ++) { - tmp = rand(); - for (j = 0; j < 4; j ++) { - if ((i * 4 + j) < len) { - buf[i * 4 + j] = (unsigned char)(tmp >> (j * 8)); - } else { - break; - } - } - - } - - return 0; -} +extern int os_get_random(unsigned char *buf, size_t len); int mbedtls_hardware_poll( void *data, unsigned char *output, size_t len, size_t *olen ) { diff --git a/components/mbedtls/port/include/aes_alt.h b/components/mbedtls/port/include/aes_alt.h index daf30d72b..7161b282c 100644 --- a/components/mbedtls/port/include/aes_alt.h +++ b/components/mbedtls/port/include/aes_alt.h @@ -29,9 +29,9 @@ extern "C" { #endif #if defined(MBEDTLS_AES_ALT) -#include "aes.h" +#include "hwcrypto/aes.h" -typedef AES_CTX mbedtls_aes_context; +typedef esp_aes_context mbedtls_aes_context; #define mbedtls_aes_init esp_aes_init #define mbedtls_aes_free esp_aes_free diff --git a/components/mbedtls/port/include/bignum_alt.h b/components/mbedtls/port/include/bignum_alt.h deleted file mode 100644 index f30d7d25c..000000000 --- a/components/mbedtls/port/include/bignum_alt.h +++ /dev/null @@ -1,77 +0,0 @@ -/** - * \file bignum_alt.h - * - * \brief Multi-precision integer library - * - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - */ - -#ifndef BIGNUM_ALT_H -#define BIGNUM_ALT_H - -#include "bignum.h" - -#if defined(MBEDTLS_BIGNUM_ALT) - -typedef MPI_CTX mbedtls_mpi; - -#define mbedtls_mpi_init esp_mpi_init -#define mbedtls_mpi_free esp_mpi_free -#define mbedtls_mpi_grow esp_mpi_grow -#define mbedtls_mpi_shrink esp_mpi_shrink -#define mbedtls_mpi_copy esp_mpi_copy -#define mbedtls_mpi_swap esp_mpi_swap -#define mbedtls_mpi_safe_cond_assign esp_mpi_safe_cond_assign -#define mbedtls_mpi_safe_cond_swap esp_mpi_safe_cond_swap -#define mbedtls_mpi_lset esp_mpi_lset -#define mbedtls_mpi_get_bit esp_mpi_get_bit -#define mbedtls_mpi_set_bit esp_mpi_set_bit -#define mbedtls_mpi_lsb esp_mpi_lsb -#define mbedtls_mpi_bitlen esp_mpi_bitlen -#define mbedtls_mpi_size esp_mpi_size -#define mbedtls_mpi_read_string esp_mpi_read_string -#define mbedtls_mpi_write_string esp_mpi_write_string -#define mbedtls_mpi_read_binary esp_mpi_read_binary -#define mbedtls_mpi_write_binary esp_mpi_write_binary -#define mbedtls_mpi_shift_l esp_mpi_shift_l -#define mbedtls_mpi_shift_r esp_mpi_shift_r -#define mbedtls_mpi_cmp_abs esp_mpi_cmp_abs -#define mbedtls_mpi_cmp_mpi esp_mpi_cmp_mpi -#define mbedtls_mpi_cmp_int esp_mpi_cmp_int -#define mbedtls_mpi_add_abs esp_mpi_add_abs -#define mbedtls_mpi_sub_abs esp_mpi_sub_abs -#define mbedtls_mpi_add_mpi esp_mpi_add_mpi -#define mbedtls_mpi_sub_mpi esp_mpi_sub_mpi -#define mbedtls_mpi_add_int esp_mpi_add_int -#define mbedtls_mpi_sub_int esp_mpi_sub_int -#define mbedtls_mpi_mul_mpi esp_mpi_mul_mpi -#define mbedtls_mpi_mul_int esp_mpi_mul_int -#define mbedtls_mpi_div_mpi esp_mpi_div_mpi -#define mbedtls_mpi_div_int esp_mpi_div_int -#define mbedtls_mpi_mod_mpi esp_mpi_mod_mpi -#define mbedtls_mpi_mod_int esp_mpi_mod_int -#define mbedtls_mpi_exp_mod esp_mpi_exp_mod -#define mbedtls_mpi_fill_random esp_mpi_fill_random -#define mbedtls_mpi_gcd esp_mpi_gcd -#define mbedtls_mpi_inv_mod esp_mpi_inv_mod -#define mbedtls_mpi_is_prime esp_mpi_is_prime -#define mbedtls_mpi_gen_prime esp_mpi_gen_prime - -#endif - -#endif - diff --git a/components/mbedtls/port/include/sha1_alt.h b/components/mbedtls/port/include/sha1_alt.h index 3cf39d2ff..60297b9fb 100644 --- a/components/mbedtls/port/include/sha1_alt.h +++ b/components/mbedtls/port/include/sha1_alt.h @@ -1,7 +1,6 @@ /* * copyright (c) 2010 - 2012 Espressif System * - * esf Link List Descriptor */ #ifndef _SHA1_ALT_H_ #define _SHA1_ALT_H_ @@ -12,9 +11,9 @@ extern "C" { #if defined(MBEDTLS_SHA1_ALT) -#include "sha.h" +#include "hwcrypto/sha.h" -typedef SHA1_CTX mbedtls_sha1_context; +typedef esp_sha_context mbedtls_sha1_context; #define mbedtls_sha1_init esp_sha1_init #define mbedtls_sha1_starts esp_sha1_start @@ -22,7 +21,7 @@ typedef SHA1_CTX mbedtls_sha1_context; #define mbedtls_sha1_update esp_sha1_update #define mbedtls_sha1_finish esp_sha1_finish #define mbedtls_sha1_free esp_sha1_free -#define mbedtls_sha1_process esp_sha1_process +#define mbedtls_sha1_process(...) #endif diff --git a/components/mbedtls/port/include/sha256_alt.h b/components/mbedtls/port/include/sha256_alt.h index 15ea356ac..6d9986b3a 100644 --- a/components/mbedtls/port/include/sha256_alt.h +++ b/components/mbedtls/port/include/sha256_alt.h @@ -1,7 +1,6 @@ /* * copyright (c) 2010 - 2012 Espressif System * - * esf Link List Descriptor */ #ifndef _SHA256_ALT_H_ @@ -13,9 +12,9 @@ extern "C" { #if defined(MBEDTLS_SHA256_ALT) -#include "sha.h" +#include "hwcrypto/sha.h" -typedef SHA256_CTX mbedtls_sha256_context; +typedef esp_sha_context mbedtls_sha256_context; #define mbedtls_sha256_init esp_sha256_init #define mbedtls_sha256_clone esp_sha256_clone @@ -23,7 +22,7 @@ typedef SHA256_CTX mbedtls_sha256_context; #define mbedtls_sha256_update esp_sha256_update #define mbedtls_sha256_finish esp_sha256_finish #define mbedtls_sha256_free esp_sha256_free -#define mbedtls_sha256_process esp_sha256_process +#define mbedtls_sha256_process(...) #endif diff --git a/components/mbedtls/port/include/sha512_alt.h b/components/mbedtls/port/include/sha512_alt.h index 9e337c1b6..c9f6bdc85 100644 --- a/components/mbedtls/port/include/sha512_alt.h +++ b/components/mbedtls/port/include/sha512_alt.h @@ -12,9 +12,9 @@ extern "C" { #endif #if defined(MBEDTLS_SHA512_ALT) -#include "sha.h" +#include "hwcrypto/sha.h" -typedef SHA512_CTX mbedtls_sha512_context; +typedef esp_sha_context mbedtls_sha512_context; #define mbedtls_sha512_init esp_sha512_init #define mbedtls_sha512_process esp_sha512_process @@ -22,7 +22,7 @@ typedef SHA512_CTX mbedtls_sha512_context; #define mbedtls_sha512_starts esp_sha512_start #define mbedtls_sha512_update esp_sha512_update #define mbedtls_sha512_finish esp_sha512_finish -#define mbedtls_sha512_free esp_sha512_free +#define mbedtls_sha512_free(...) #endif