x448.c
Go to the documentation of this file.
1 /**
2  * @file x448.c
3  * @brief X448 function implementation
4  *
5  * @section License
6  *
7  * SPDX-License-Identifier: GPL-2.0-or-later
8  *
9  * Copyright (C) 2010-2020 Oryx Embedded SARL. All rights reserved.
10  *
11  * This file is part of CycloneCRYPTO Open.
12  *
13  * This program is free software; you can redistribute it and/or
14  * modify it under the terms of the GNU General Public License
15  * as published by the Free Software Foundation; either version 2
16  * of the License, or (at your option) any later version.
17  *
18  * This program is distributed in the hope that it will be useful,
19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21  * GNU General Public License for more details.
22  *
23  * You should have received a copy of the GNU General Public License
24  * along with this program; if not, write to the Free Software Foundation,
25  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
26  *
27  * @author Oryx Embedded SARL (www.oryx-embedded.com)
28  * @version 1.9.8
29  **/
30 
31 //Switch to the appropriate trace level
32 #define TRACE_LEVEL CRYPTO_TRACE_LEVEL
33 
34 //Dependencies
35 #include "core/crypto.h"
36 #include "ecc/ec_curves.h"
37 #include "ecc/curve448.h"
38 #include "ecc/x448.h"
39 #include "debug.h"
40 
41 //Check crypto library configuration
42 #if (X448_SUPPORT == ENABLED)
43 
44 
45 /**
46  * @brief X448 function (scalar multiplication on Curve448)
47  * @param[out] r Output u-coordinate
48  * @param[in] k Input scalar
49  * @param[in] u Input u-coordinate
50  * @return Error code
51  **/
52 
53 error_t x448(uint8_t *r, const uint8_t *k, const uint8_t *u)
54 {
55  int_t i;
56  uint32_t b;
57  uint32_t swap;
58  X448State *state;
59 
60  //Check parameters
61  if(r == NULL || k == NULL || u == NULL)
63 
64  //Allocate working state
65  state = cryptoAllocMem(sizeof(X448State));
66  //Failed to allocate memory?
67  if(state == NULL)
68  return ERROR_OUT_OF_MEMORY;
69 
70  //Copy scalar
71  curve448Import(state->k, k);
72 
73  //Set the two least significant bits of the first byte to 0, and the most
74  //significant bit of the last byte to 1
75  state->k[0] &= 0xFFFFFFFC;
76  state->k[13] |= 0x80000000;
77 
78  //Copy input u-coordinate
79  curve448Import(state->u, u);
80 
81  //Implementations must accept non-canonical values and process them as
82  //if they had been reduced modulo the field prime (refer to RFC 7748,
83  //section 5)
84  curve448Red(state->u, state->u, 0);
85 
86  //Set X1 = 1
87  curve448SetInt(state->x1, 1);
88  //Set Z1 = 0
89  curve448SetInt(state->z1, 0);
90  //Set X2 = U
91  curve448Copy(state->x2, state->u);
92  //Set Z2 = 1
93  curve448SetInt(state->z2, 1);
94 
95  //Set swap = 0
96  swap = 0;
97 
98  //Montgomery ladder
99  for(i = CURVE448_BIT_LEN - 1; i >= 0; i--)
100  {
101  //The scalar is processed in a left-to-right fashion
102  b = (state->k[i / 32] >> (i % 32)) & 1;
103 
104  //Conditional swap
105  curve448Swap(state->x1, state->x2, swap ^ b);
106  curve448Swap(state->z1, state->z2, swap ^ b);
107 
108  //Save current bit value
109  swap = b;
110 
111  //Compute T1 = X2 + Z2
112  curve448Add(state->t1, state->x2, state->z2);
113  //Compute X2 = X2 - Z2
114  curve448Sub(state->x2, state->x2, state->z2);
115  //Compute Z2 = X1 + Z1
116  curve448Add(state->z2, state->x1, state->z1);
117  //Compute X1 = X1 - Z1
118  curve448Sub(state->x1, state->x1, state->z1);
119  //Compute T1 = T1 * X1
120  curve448Mul(state->t1, state->t1, state->x1);
121  //Compute X2 = X2 * Z2
122  curve448Mul(state->x2, state->x2, state->z2);
123  //Compute Z2 = Z2 * Z2
124  curve448Sqr(state->z2, state->z2);
125  //Compute X1 = X1 * X1
126  curve448Sqr(state->x1, state->x1);
127  //Compute T2 = Z2 - X1
128  curve448Sub(state->t2, state->z2, state->x1);
129  //Compute Z1 = T2 * a24
130  curve448MulInt(state->z1, state->t2, CURVE448_A24);
131  //Compute Z1 = Z1 + X1
132  curve448Add(state->z1, state->z1, state->x1);
133  //Compute Z1 = Z1 * T2
134  curve448Mul(state->z1, state->z1, state->t2);
135  //Compute X1 = X1 * Z2
136  curve448Mul(state->x1, state->x1, state->z2);
137  //Compute Z2 = T1 - X2
138  curve448Sub(state->z2, state->t1, state->x2);
139  //Compute Z2 = Z2 * Z2
140  curve448Sqr(state->z2, state->z2);
141  //Compute Z2 = Z2 * U
142  curve448Mul(state->z2, state->z2, state->u);
143  //Compute X2 = X2 + T1
144  curve448Add(state->x2, state->x2, state->t1);
145  //Compute X2 = X2 * X2
146  curve448Sqr(state->x2, state->x2);
147  }
148 
149  //Conditional swap
150  curve448Swap(state->x1, state->x2, swap);
151  curve448Swap(state->z1, state->z2, swap);
152 
153  //Retrieve affine representation
154  curve448Inv(state->u, state->z1);
155  curve448Mul(state->u, state->u, state->x1);
156 
157  //Copy output u-coordinate
158  curve448Export(state->u, r);
159 
160  //Erase working state
161  osMemset(state, 0, sizeof(X448State));
162  //Release working state
163  cryptoFreeMem(state);
164 
165  //Successful processing
166  return NO_ERROR;
167 }
168 
169 #endif
Curve448 elliptic curve (constant-time implementation)
error_t x448(uint8_t *r, const uint8_t *k, const uint8_t *u)
X448 function (scalar multiplication on Curve448)
Definition: x448.c:53
signed int int_t
Definition: compiler_port.h:44
#define CURVE448_BIT_LEN
Definition: curve448.h:38
void curve448Export(uint32_t *a, uint8_t *data)
Export an octet string.
Definition: curve448.c:647
void curve448Copy(uint32_t *a, const uint32_t *b)
Copy an integer.
Definition: curve448.c:528
uint32_t u[14]
Definition: x448.h:51
void curve448MulInt(uint32_t *r, const uint32_t *a, uint32_t b)
Modular multiplication.
Definition: curve448.c:291
uint32_t t1[14]
Definition: x448.h:56
X448 function implementation.
uint32_t r
Definition: ndp.h:345
uint32_t t2[14]
Definition: x448.h:57
Invalid parameter.
Definition: error.h:47
error_t
Error codes.
Definition: error.h:42
void curve448Import(uint32_t *a, const uint8_t *data)
Import an octet string.
Definition: curve448.c:626
void curve448Inv(uint32_t *r, const uint32_t *a)
Modular multiplicative inverse.
Definition: curve448.c:403
void curve448Sqr(uint32_t *r, const uint32_t *a)
Modular squaring.
Definition: curve448.c:332
General definitions for cryptographic algorithms.
#define CURVE448_A24
Definition: curve448.h:43
uint32_t z2[14]
Definition: x448.h:55
void curve448SetInt(uint32_t *a, uint32_t b)
Set integer value.
Definition: curve448.c:50
uint32_t k[14]
Definition: x448.h:50
void curve448Swap(uint32_t *a, uint32_t *b, uint32_t c)
Conditional swap.
Definition: curve448.c:547
X448 working state.
Definition: x448.h:48
uint8_t b[6]
Definition: ethernet.h:179
uint32_t z1[14]
Definition: x448.h:53
#define cryptoFreeMem(p)
Definition: crypto.h:630
void curve448Add(uint32_t *r, const uint32_t *a, const uint32_t *b)
Modular addition.
Definition: curve448.c:72
#define cryptoAllocMem(size)
Definition: crypto.h:625
void curve448Sub(uint32_t *r, const uint32_t *a, const uint32_t *b)
Modular subtraction.
Definition: curve448.c:123
void curve448Mul(uint32_t *r, const uint32_t *a, const uint32_t *b)
Modular multiplication.
Definition: curve448.c:199
void curve448Red(uint32_t *r, const uint32_t *a, uint32_t h)
Modular reduction.
Definition: curve448.c:368
Elliptic curves.
#define osMemset(p, value, length)
Definition: os_port.h:128
uint32_t x2[14]
Definition: x448.h:54
Success.
Definition: error.h:44
uint32_t x1[14]
Definition: x448.h:52
Debugging facilities.