From: jsing Date: Sat, 24 Jun 2023 17:49:44 +0000 (+0000) Subject: Mop up EC_GROUP precomp machinery. X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=8294d15d3f77089013ce15750e769063decd881c;p=openbsd Mop up EC_GROUP precomp machinery. Since there are now no EC implementations that perform pre-computation at the EC_GROUP level, remove all of the precomp machinery, including the extra_data EC_GROUP member. The ec_wNAF_mul() code is horrific - simply cut out the precomp code, rather than trying to rewrite it (that's a project for another day). ok tb@ --- diff --git a/lib/libcrypto/ec/ec_lib.c b/lib/libcrypto/ec/ec_lib.c index 817b0239be5..93a90651290 100644 --- a/lib/libcrypto/ec/ec_lib.c +++ b/lib/libcrypto/ec/ec_lib.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ec_lib.c,v 1.58 2023/06/20 14:37:15 tb Exp $ */ +/* $OpenBSD: ec_lib.c,v 1.59 2023/06/24 17:49:44 jsing Exp $ */ /* * Originally written by Bodo Moeller for the OpenSSL project. */ @@ -93,8 +93,6 @@ EC_GROUP_new(const EC_METHOD *meth) } ret->meth = meth; - ret->extra_data = NULL; - ret->generator = NULL; BN_init(&ret->order); BN_init(&ret->cofactor); @@ -123,8 +121,6 @@ EC_GROUP_free(EC_GROUP *group) if (group->meth->group_finish != NULL) group->meth->group_finish(group); - EC_EX_DATA_clear_free_all_data(&group->extra_data); - EC_POINT_free(group->generator); BN_free(&group->order); BN_free(&group->cofactor); @@ -142,8 +138,6 @@ EC_GROUP_clear_free(EC_GROUP *group) int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src) { - EC_EXTRA_DATA *d; - if (dest->meth->group_copy == NULL) { ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return 0; @@ -155,18 +149,6 @@ EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src) if (dest == src) return 1; - EC_EX_DATA_free_all_data(&dest->extra_data); - - for (d = src->extra_data; d != NULL; d = d->next) { - void *t = d->dup_func(d->data); - - if (t == NULL) - return 0; - if (!EC_EX_DATA_set_data(&dest->extra_data, t, d->dup_func, - d->free_func, d->clear_free_func)) - return 0; - } - if (src->generator != NULL) { if (dest->generator == NULL) { dest->generator = EC_POINT_new(dest); diff --git a/lib/libcrypto/ec/ec_local.h b/lib/libcrypto/ec/ec_local.h index d178665c1fe..c0689a3c3e6 100644 --- a/lib/libcrypto/ec/ec_local.h +++ b/lib/libcrypto/ec/ec_local.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ec_local.h,v 1.15 2023/06/24 17:18:15 jsing Exp $ */ +/* $OpenBSD: ec_local.h,v 1.16 2023/06/24 17:49:44 jsing Exp $ */ /* * Originally written by Bodo Moeller for the OpenSSL project. */ @@ -209,8 +209,6 @@ struct ec_group_st { * if they appear to be generic. */ - EC_EXTRA_DATA *extra_data; - /* * Field specification. For GF(p) this is the modulus; for GF(2^m), * this is the irreducible polynomial defining the field. diff --git a/lib/libcrypto/ec/ec_mult.c b/lib/libcrypto/ec/ec_mult.c index 61428eb142c..a0e97437bb6 100644 --- a/lib/libcrypto/ec/ec_mult.c +++ b/lib/libcrypto/ec/ec_mult.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ec_mult.c,v 1.30 2023/06/24 17:18:15 jsing Exp $ */ +/* $OpenBSD: ec_mult.c,v 1.31 2023/06/24 17:49:44 jsing Exp $ */ /* * Originally written by Bodo Moeller and Nils Larsch for the OpenSSL project. */ @@ -67,7 +67,6 @@ #include "ec_local.h" - /* * This file implements the wNAF-based interleaving multi-exponentation method * (); @@ -75,91 +74,6 @@ * (). */ - - - -/* structure for precomputed multiples of the generator */ -typedef struct ec_pre_comp_st { - const EC_GROUP *group; /* parent EC_GROUP object */ - size_t blocksize; /* block size for wNAF splitting */ - size_t numblocks; /* max. number of blocks for which we have - * precomputation */ - size_t w; /* window size */ - EC_POINT **points; /* array with pre-calculated multiples of - * generator: 'num' pointers to EC_POINT - * objects followed by a NULL */ - size_t num; /* numblocks * 2^(w-1) */ - int references; -} EC_PRE_COMP; - -/* functions to manage EC_PRE_COMP within the EC_GROUP extra_data framework */ -static void *ec_pre_comp_dup(void *); -static void ec_pre_comp_free(void *); -static void ec_pre_comp_clear_free(void *); - -static void * -ec_pre_comp_dup(void *src_) -{ - EC_PRE_COMP *src = src_; - - /* no need to actually copy, these objects never change! */ - - CRYPTO_add(&src->references, 1, CRYPTO_LOCK_EC_PRE_COMP); - - return src_; -} - -static void -ec_pre_comp_free(void *pre_) -{ - int i; - EC_PRE_COMP *pre = pre_; - - if (!pre) - return; - - i = CRYPTO_add(&pre->references, -1, CRYPTO_LOCK_EC_PRE_COMP); - if (i > 0) - return; - - if (pre->points) { - EC_POINT **p; - - for (p = pre->points; *p != NULL; p++) - EC_POINT_free(*p); - free(pre->points); - } - free(pre); -} - -static void -ec_pre_comp_clear_free(void *pre_) -{ - int i; - EC_PRE_COMP *pre = pre_; - - if (!pre) - return; - - i = CRYPTO_add(&pre->references, -1, CRYPTO_LOCK_EC_PRE_COMP); - if (i > 0) - return; - - if (pre->points) { - EC_POINT **p; - - for (p = pre->points; *p != NULL; p++) { - EC_POINT_free(*p); - explicit_bzero(p, sizeof *p); - } - free(pre->points); - } - freezero(pre, sizeof *pre); -} - - - - /* Determine the modified width-(w+1) Non-Adjacent Form (wNAF) of 'scalar'. * This is an array r[] of values that are either zero or odd with an * absolute value less than 2^w satisfying @@ -315,8 +229,7 @@ ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, const EC_POINT *generator = NULL; EC_POINT *tmp = NULL; size_t totalnum; - size_t blocksize = 0, numblocks = 0; /* for wNAF splitting */ - size_t pre_points_per_block = 0; + size_t numblocks = 0; /* for wNAF splitting */ size_t i, j; int k; int r_is_inverted = 0; @@ -331,7 +244,6 @@ ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, EC_POINT **v; EC_POINT ***val_sub = NULL; /* pointers to sub-arrays of 'val' or * 'pre_comp->points' */ - const EC_PRE_COMP *pre_comp = NULL; int num_scalar = 0; /* flag: will be set to 1 if 'scalar' must be * treated like other scalars, i.e. * precomputation is not available */ @@ -357,42 +269,10 @@ ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, ECerror(EC_R_UNDEFINED_GENERATOR); goto err; } - /* look if we can use precomputed multiples of generator */ - - pre_comp = EC_EX_DATA_get_data(group->extra_data, ec_pre_comp_dup, ec_pre_comp_free, ec_pre_comp_clear_free); - - if (pre_comp && pre_comp->numblocks && - (EC_POINT_cmp(group, generator, pre_comp->points[0], ctx) == 0)) { - blocksize = pre_comp->blocksize; - - /* - * determine maximum number of blocks that wNAF - * splitting may yield (NB: maximum wNAF length is - * bit length plus one) - */ - numblocks = (BN_num_bits(scalar) / blocksize) + 1; - /* - * we cannot use more blocks than we have - * precomputation for - */ - if (numblocks > pre_comp->numblocks) - numblocks = pre_comp->numblocks; - - pre_points_per_block = (size_t) 1 << (pre_comp->w - 1); - - /* check that pre_comp looks sane */ - if (pre_comp->num != (pre_comp->numblocks * pre_points_per_block)) { - ECerror(ERR_R_INTERNAL_ERROR); - goto err; - } - } else { - /* can't use precomputation */ - pre_comp = NULL; - numblocks = 1; - num_scalar = 1; /* treat 'scalar' like 'num'-th - * element of 'scalars' */ - } + numblocks = 1; + num_scalar = 1; /* treat 'scalar' like 'num'-th + * element of 'scalars' */ } totalnum = num + numblocks; @@ -434,111 +314,9 @@ ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, if (numblocks) { /* we go here iff scalar != NULL */ - if (pre_comp == NULL) { - if (num_scalar != 1) { - ECerror(ERR_R_INTERNAL_ERROR); - goto err; - } - /* we have already generated a wNAF for 'scalar' */ - } else { - size_t tmp_len = 0; - - if (num_scalar != 0) { - ECerror(ERR_R_INTERNAL_ERROR); - goto err; - } - /* - * use the window size for which we have - * precomputation - */ - wsize[num] = pre_comp->w; - tmp_wNAF = compute_wNAF(scalar, wsize[num], &tmp_len); - if (tmp_wNAF == NULL) - goto err; - - if (tmp_len <= max_len) { - /* - * One of the other wNAFs is at least as long - * as the wNAF belonging to the generator, so - * wNAF splitting will not buy us anything. - */ - - numblocks = 1; - totalnum = num + 1; /* don't use wNAF - * splitting */ - wNAF[num] = tmp_wNAF; - tmp_wNAF = NULL; - wNAF[num + 1] = NULL; - wNAF_len[num] = tmp_len; - if (tmp_len > max_len) - max_len = tmp_len; - /* - * pre_comp->points starts with the points - * that we need here: - */ - val_sub[num] = pre_comp->points; - } else { - /* - * don't include tmp_wNAF directly into wNAF - * array - use wNAF splitting and include the - * blocks - */ - - signed char *pp; - EC_POINT **tmp_points; - - if (tmp_len < numblocks * blocksize) { - /* - * possibly we can do with fewer - * blocks than estimated - */ - numblocks = (tmp_len + blocksize - 1) / blocksize; - if (numblocks > pre_comp->numblocks) { - ECerror(ERR_R_INTERNAL_ERROR); - goto err; - } - totalnum = num + numblocks; - } - /* split wNAF in 'numblocks' parts */ - pp = tmp_wNAF; - tmp_points = pre_comp->points; - - for (i = num; i < totalnum; i++) { - if (i < totalnum - 1) { - wNAF_len[i] = blocksize; - if (tmp_len < blocksize) { - ECerror(ERR_R_INTERNAL_ERROR); - goto err; - } - tmp_len -= blocksize; - } else - /* - * last block gets whatever - * is left (this could be - * more or less than - * 'blocksize'!) - */ - wNAF_len[i] = tmp_len; - - wNAF[i + 1] = NULL; - wNAF[i] = malloc(wNAF_len[i]); - if (wNAF[i] == NULL) { - ECerror(ERR_R_MALLOC_FAILURE); - goto err; - } - memcpy(wNAF[i], pp, wNAF_len[i]); - if (wNAF_len[i] > max_len) - max_len = wNAF_len[i]; - - if (*tmp_points == NULL) { - ECerror(ERR_R_INTERNAL_ERROR); - goto err; - } - val_sub[i] = tmp_points; - tmp_points += pre_points_per_block; - pp += blocksize; - } - } + if (num_scalar != 1) { + ECerror(ERR_R_INTERNAL_ERROR); + goto err; } } /*