1/* 2 * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org> 3 * 4 * Permission is hereby granted, free of charge, to any person obtaining 5 * a copy of this software and associated documentation files (the 6 * "Software"), to deal in the Software without restriction, including 7 * without limitation the rights to use, copy, modify, merge, publish, 8 * distribute, sublicense, and/or sell copies of the Software, and to 9 * permit persons to whom the Software is furnished to do so, subject to 10 * the following conditions: 11 * 12 * The above copyright notice and this permission notice shall be 13 * included in all copies or substantial portions of the Software. 14 * 15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 16 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 17 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 18 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 19 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 20 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 21 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 22 * SOFTWARE. 23 */ 24 25#ifndef INNER_H__ 26#define INNER_H__ 27 28#include <string.h> 29#include <limits.h> 30 31#include "config.h" 32#include "bearssl.h" 33 34/* 35 * On MSVC, disable the warning about applying unary minus on an 36 * unsigned type: it is standard, we do it all the time, and for 37 * good reasons. 38 */ 39#if _MSC_VER 40#pragma warning( disable : 4146 ) 41#endif 42 43/* 44 * Maximum size for a RSA modulus (in bits). Allocated stack buffers 45 * depend on that size, so this value should be kept small. Currently, 46 * 2048-bit RSA keys offer adequate security, and should still do so for 47 * the next few decades; however, a number of widespread PKI have 48 * already set their root keys to RSA-4096, so we should be able to 49 * process such keys. 50 * 51 * This value MUST be a multiple of 64. This value MUST NOT exceed 47666 52 * (some computations in RSA key generation rely on the factor size being 53 * no more than 23833 bits). RSA key sizes beyond 3072 bits don't make a 54 * lot of sense anyway. 55 */ 56#define BR_MAX_RSA_SIZE 4096 57 58/* 59 * Minimum size for a RSA modulus (in bits); this value is used only to 60 * filter out invalid parameters for key pair generation. Normally, 61 * applications should not use RSA keys smaller than 2048 bits; but some 62 * specific cases might need shorter keys, for legacy or research 63 * purposes. 64 */ 65#define BR_MIN_RSA_SIZE 512 66 67/* 68 * Maximum size for a RSA factor (in bits). This is for RSA private-key 69 * operations. Default is to support factors up to a bit more than half 70 * the maximum modulus size. 71 * 72 * This value MUST be a multiple of 32. 73 */ 74#define BR_MAX_RSA_FACTOR ((BR_MAX_RSA_SIZE + 64) >> 1) 75 76/* 77 * Maximum size for an EC curve (modulus or order), in bits. Size of 78 * stack buffers depends on that parameter. This size MUST be a multiple 79 * of 8 (so that decoding an integer with that many bytes does not 80 * overflow). 81 */ 82#define BR_MAX_EC_SIZE 528 83 84/* 85 * Some macros to recognize the current architecture. Right now, we are 86 * interested into automatically recognizing architecture with efficient 87 * 64-bit types so that we may automatically use implementations that 88 * use 64-bit registers in that case. Future versions may detect, e.g., 89 * availability of SSE2 intrinsics. 90 * 91 * If 'unsigned long' is a 64-bit type, then we assume that 64-bit types 92 * are efficient. Otherwise, we rely on macros that depend on compiler, 93 * OS and architecture. In any case, failure to detect the architecture 94 * as 64-bit means that the 32-bit code will be used, and that code 95 * works also on 64-bit architectures (the 64-bit code may simply be 96 * more efficient). 97 * 98 * The test on 'unsigned long' should already catch most cases, the one 99 * notable exception being Windows code where 'unsigned long' is kept to 100 * 32-bit for compatibility with all the legacy code that liberally uses 101 * the 'DWORD' type for 32-bit values. 102 * 103 * Macro names are taken from: http://nadeausoftware.com/articles/2012/02/c_c_tip_how_detect_processor_type_using_compiler_predefined_macros 104 */ 105#ifndef BR_64 106#if ((ULONG_MAX >> 31) >> 31) == 3 107#define BR_64 1 108#elif defined(__ia64) || defined(__itanium__) || defined(_M_IA64) 109#define BR_64 1 110#elif defined(__powerpc64__) || defined(__ppc64__) || defined(__PPC64__) \ 111 || defined(__64BIT__) || defined(_LP64) || defined(__LP64__) 112#define BR_64 1 113#elif defined(__sparc64__) 114#define BR_64 1 115#elif defined(__x86_64__) || defined(_M_X64) 116#define BR_64 1 117#elif defined(__aarch64__) || defined(_M_ARM64) 118#define BR_64 1 119#elif defined(__mips64) 120#define BR_64 1 121#endif 122#endif 123 124/* 125 * Set BR_LOMUL on platforms where it makes sense. 126 */ 127#ifndef BR_LOMUL 128#if BR_ARMEL_CORTEXM_GCC 129#define BR_LOMUL 1 130#endif 131#endif 132 133/* 134 * Architecture detection. 135 */ 136#ifndef BR_i386 137#if __i386__ || _M_IX86 138#define BR_i386 1 139#endif 140#endif 141 142#ifndef BR_amd64 143#if __x86_64__ || _M_X64 144#define BR_amd64 1 145#endif 146#endif 147 148/* 149 * Compiler brand and version. 150 * 151 * Implementations that use intrinsics need to detect the compiler type 152 * and version because some specific actions may be needed to activate 153 * the corresponding opcodes, both for header inclusion, and when using 154 * them in a function. 155 * 156 * BR_GCC, BR_CLANG and BR_MSC will be set to 1 for, respectively, GCC, 157 * Clang and MS Visual C. For each of them, sub-macros will be defined 158 * for versions; each sub-macro is set whenever the compiler version is 159 * at least as recent as the one corresponding to the macro. 160 */ 161 162/* 163 * GCC thresholds are on versions 4.4 to 4.9 and 5.0. 164 */ 165#ifndef BR_GCC 166#if __GNUC__ && !__clang__ 167#define BR_GCC 1 168 169#if __GNUC__ > 4 170#define BR_GCC_5_0 1 171#elif __GNUC__ == 4 && __GNUC_MINOR__ >= 9 172#define BR_GCC_4_9 1 173#elif __GNUC__ == 4 && __GNUC_MINOR__ >= 8 174#define BR_GCC_4_8 1 175#elif __GNUC__ == 4 && __GNUC_MINOR__ >= 7 176#define BR_GCC_4_7 1 177#elif __GNUC__ == 4 && __GNUC_MINOR__ >= 6 178#define BR_GCC_4_6 1 179#elif __GNUC__ == 4 && __GNUC_MINOR__ >= 5 180#define BR_GCC_4_5 1 181#elif __GNUC__ == 4 && __GNUC_MINOR__ >= 4 182#define BR_GCC_4_4 1 183#endif 184 185#if BR_GCC_5_0 186#define BR_GCC_4_9 1 187#endif 188#if BR_GCC_4_9 189#define BR_GCC_4_8 1 190#endif 191#if BR_GCC_4_8 192#define BR_GCC_4_7 1 193#endif 194#if BR_GCC_4_7 195#define BR_GCC_4_6 1 196#endif 197#if BR_GCC_4_6 198#define BR_GCC_4_5 1 199#endif 200#if BR_GCC_4_5 201#define BR_GCC_4_4 1 202#endif 203 204#endif 205#endif 206 207/* 208 * Clang thresholds are on versions 3.7.0 and 3.8.0. 209 */ 210#ifndef BR_CLANG 211#if __clang__ 212#define BR_CLANG 1 213 214#if __clang_major__ > 3 || (__clang_major__ == 3 && __clang_minor__ >= 8) 215#define BR_CLANG_3_8 1 216#elif __clang_major__ == 3 && __clang_minor__ >= 7 217#define BR_CLANG_3_7 1 218#endif 219 220#if BR_CLANG_3_8 221#define BR_CLANG_3_7 1 222#endif 223 224#endif 225#endif 226 227/* 228 * MS Visual C thresholds are on Visual Studio 2005 to 2015. 229 */ 230#ifndef BR_MSC 231#if _MSC_VER 232#define BR_MSC 1 233 234#if _MSC_VER >= 1900 235#define BR_MSC_2015 1 236#elif _MSC_VER >= 1800 237#define BR_MSC_2013 1 238#elif _MSC_VER >= 1700 239#define BR_MSC_2012 1 240#elif _MSC_VER >= 1600 241#define BR_MSC_2010 1 242#elif _MSC_VER >= 1500 243#define BR_MSC_2008 1 244#elif _MSC_VER >= 1400 245#define BR_MSC_2005 1 246#endif 247 248#if BR_MSC_2015 249#define BR_MSC_2013 1 250#endif 251#if BR_MSC_2013 252#define BR_MSC_2012 1 253#endif 254#if BR_MSC_2012 255#define BR_MSC_2010 1 256#endif 257#if BR_MSC_2010 258#define BR_MSC_2008 1 259#endif 260#if BR_MSC_2008 261#define BR_MSC_2005 1 262#endif 263 264#endif 265#endif 266 267/* 268 * GCC 4.4+ and Clang 3.7+ allow tagging specific functions with a 269 * 'target' attribute that activates support for specific opcodes. 270 */ 271#if BR_GCC_4_4 || BR_CLANG_3_7 272#define BR_TARGET(x) __attribute__((target(x))) 273#else 274#define BR_TARGET(x) 275#endif 276 277/* 278 * AES-NI intrinsics are available on x86 (32-bit and 64-bit) with 279 * GCC 4.8+, Clang 3.7+ and MSC 2012+. 280 */ 281#ifndef BR_AES_X86NI 282#if (BR_i386 || BR_amd64) && (BR_GCC_4_8 || BR_CLANG_3_7 || BR_MSC_2012) 283#define BR_AES_X86NI 1 284#endif 285#endif 286 287/* 288 * SSE2 intrinsics are available on x86 (32-bit and 64-bit) with 289 * GCC 4.4+, Clang 3.7+ and MSC 2005+. 290 */ 291#ifndef BR_SSE2 292#if (BR_i386 || BR_amd64) && (BR_GCC_4_4 || BR_CLANG_3_7 || BR_MSC_2005) 293#define BR_SSE2 1 294#endif 295#endif 296 297/* 298 * RDRAND intrinsics are available on x86 (32-bit and 64-bit) with 299 * GCC 4.6+, Clang 3.7+ and MSC 2012+. 300 */ 301#ifndef BR_RDRAND 302#if (BR_i386 || BR_amd64) && (BR_GCC_4_6 || BR_CLANG_3_7 || BR_MSC_2012) 303#define BR_RDRAND 1 304#endif 305#endif 306 307/* 308 * Determine type of OS for random number generation. Macro names and 309 * values are documented on: 310 * https://sourceforge.net/p/predef/wiki/OperatingSystems/ 311 * 312 * TODO: enrich the list of detected system. Also add detection for 313 * alternate system calls like getentropy(), which are usually 314 * preferable when available. 315 */ 316 317#ifndef BR_USE_URANDOM 318#if defined _AIX \ 319 || defined __ANDROID__ \ 320 || defined __FreeBSD__ \ 321 || defined __NetBSD__ \ 322 || defined __OpenBSD__ \ 323 || defined __DragonFly__ \ 324 || defined __linux__ \ 325 || (defined __sun && (defined __SVR4 || defined __svr4__)) \ 326 || (defined __APPLE__ && defined __MACH__) 327#define BR_USE_URANDOM 1 328#endif 329#endif 330 331#ifndef BR_USE_WIN32_RAND 332#if defined _WIN32 || defined _WIN64 333#define BR_USE_WIN32_RAND 1 334#endif 335#endif 336 337/* 338 * POWER8 crypto support. We rely on compiler macros for the 339 * architecture, since we do not have a reliable, simple way to detect 340 * the required support at runtime (we could try running an opcode, and 341 * trapping the exception or signal on illegal instruction, but this 342 * induces some non-trivial OS dependencies that we would prefer to 343 * avoid if possible). 344 */ 345#ifndef BR_POWER8 346#if __GNUC__ && ((_ARCH_PWR8 || _ARCH_PPC) && __CRYPTO__) 347#define BR_POWER8 1 348#endif 349#endif 350 351/* 352 * Detect endinanness on POWER8. 353 */ 354#if BR_POWER8 355#if defined BR_POWER8_LE 356#undef BR_POWER8_BE 357#if BR_POWER8_LE 358#define BR_POWER8_BE 0 359#else 360#define BR_POWER8_BE 1 361#endif 362#elif defined BR_POWER8_BE 363#undef BR_POWER8_LE 364#if BR_POWER8_BE 365#define BR_POWER8_LE 0 366#else 367#define BR_POWER8_LE 1 368#endif 369#else 370#if __LITTLE_ENDIAN__ 371#define BR_POWER8_LE 1 372#define BR_POWER8_BE 0 373#else 374#define BR_POWER8_LE 0 375#define BR_POWER8_BE 1 376#endif 377#endif 378#endif 379 380/* 381 * Detect support for 128-bit integers. 382 */ 383#if !defined BR_INT128 && !defined BR_UMUL128 384#ifdef __SIZEOF_INT128__ 385#define BR_INT128 1 386#elif _M_X64 387#define BR_UMUL128 1 388#endif 389#endif 390 391/* 392 * Detect support for unaligned accesses with known endianness. 393 * 394 * x86 (both 32-bit and 64-bit) is little-endian and allows unaligned 395 * accesses. 396 * 397 * POWER/PowerPC allows unaligned accesses when big-endian. POWER8 and 398 * later also allow unaligned accesses when little-endian. 399 */ 400#if !defined BR_LE_UNALIGNED && !defined BR_BE_UNALIGNED 401 402#if __i386 || __i386__ || __x86_64__ || _M_IX86 || _M_X64 403#define BR_LE_UNALIGNED 1 404#elif BR_POWER8_BE 405#define BR_BE_UNALIGNED 1 406#elif BR_POWER8_LE 407#define BR_LE_UNALIGNED 1 408#elif (__powerpc__ || __powerpc64__ || _M_PPC || _ARCH_PPC || _ARCH_PPC64) \ 409 && __BIG_ENDIAN__ 410#define BR_BE_UNALIGNED 1 411#endif 412 413#endif 414 415/* 416 * Detect support for an OS-provided time source. 417 */ 418 419#ifndef BR_USE_UNIX_TIME 420#if defined __unix__ || defined __linux__ \ 421 || defined _POSIX_SOURCE || defined _POSIX_C_SOURCE \ 422 || (defined __APPLE__ && defined __MACH__) 423#define BR_USE_UNIX_TIME 1 424#endif 425#endif 426 427#ifndef BR_USE_WIN32_TIME 428#if defined _WIN32 || defined _WIN64 429#define BR_USE_WIN32_TIME 1 430#endif 431#endif 432 433/* ==================================================================== */ 434/* 435 * Encoding/decoding functions. 436 * 437 * 32-bit and 64-bit decoding, both little-endian and big-endian, is 438 * implemented with the inline functions below. 439 * 440 * When allowed by some compile-time options (autodetected or provided), 441 * optimised code is used, to perform direct memory access when the 442 * underlying architecture supports it, both for endianness and 443 * alignment. This, however, may trigger strict aliasing issues; the 444 * code below uses unions to perform (supposedly) safe type punning. 445 * Since the C aliasing rules are relatively complex and were amended, 446 * or at least re-explained with different phrasing, in all successive 447 * versions of the C standard, it is always a bit risky to bet that any 448 * specific version of a C compiler got it right, for some notion of 449 * "right". 450 */ 451 452typedef union { 453 uint16_t u; 454 unsigned char b[sizeof(uint16_t)]; 455} br_union_u16; 456 457typedef union { 458 uint32_t u; 459 unsigned char b[sizeof(uint32_t)]; 460} br_union_u32; 461 462typedef union { 463 uint64_t u; 464 unsigned char b[sizeof(uint64_t)]; 465} br_union_u64; 466 467static inline void 468br_enc16le(void *dst, unsigned x) 469{ 470#if BR_LE_UNALIGNED 471 ((br_union_u16 *)dst)->u = x; 472#else 473 unsigned char *buf; 474 475 buf = dst; 476 buf[0] = (unsigned char)x; 477 buf[1] = (unsigned char)(x >> 8); 478#endif 479} 480 481static inline void 482br_enc16be(void *dst, unsigned x) 483{ 484#if BR_BE_UNALIGNED 485 ((br_union_u16 *)dst)->u = x; 486#else 487 unsigned char *buf; 488 489 buf = dst; 490 buf[0] = (unsigned char)(x >> 8); 491 buf[1] = (unsigned char)x; 492#endif 493} 494 495static inline unsigned 496br_dec16le(const void *src) 497{ 498#if BR_LE_UNALIGNED 499 return ((const br_union_u16 *)src)->u; 500#else 501 const unsigned char *buf; 502 503 buf = src; 504 return (unsigned)buf[0] | ((unsigned)buf[1] << 8); 505#endif 506} 507 508static inline unsigned 509br_dec16be(const void *src) 510{ 511#if BR_BE_UNALIGNED 512 return ((const br_union_u16 *)src)->u; 513#else 514 const unsigned char *buf; 515 516 buf = src; 517 return ((unsigned)buf[0] << 8) | (unsigned)buf[1]; 518#endif 519} 520 521static inline void 522br_enc32le(void *dst, uint32_t x) 523{ 524#if BR_LE_UNALIGNED 525 ((br_union_u32 *)dst)->u = x; 526#else 527 unsigned char *buf; 528 529 buf = dst; 530 buf[0] = (unsigned char)x; 531 buf[1] = (unsigned char)(x >> 8); 532 buf[2] = (unsigned char)(x >> 16); 533 buf[3] = (unsigned char)(x >> 24); 534#endif 535} 536 537static inline void 538br_enc32be(void *dst, uint32_t x) 539{ 540#if BR_BE_UNALIGNED 541 ((br_union_u32 *)dst)->u = x; 542#else 543 unsigned char *buf; 544 545 buf = dst; 546 buf[0] = (unsigned char)(x >> 24); 547 buf[1] = (unsigned char)(x >> 16); 548 buf[2] = (unsigned char)(x >> 8); 549 buf[3] = (unsigned char)x; 550#endif 551} 552 553static inline uint32_t 554br_dec32le(const void *src) 555{ 556#if BR_LE_UNALIGNED 557 return ((const br_union_u32 *)src)->u; 558#else 559 const unsigned char *buf; 560 561 buf = src; 562 return (uint32_t)buf[0] 563 | ((uint32_t)buf[1] << 8) 564 | ((uint32_t)buf[2] << 16) 565 | ((uint32_t)buf[3] << 24); 566#endif 567} 568 569static inline uint32_t 570br_dec32be(const void *src) 571{ 572#if BR_BE_UNALIGNED 573 return ((const br_union_u32 *)src)->u; 574#else 575 const unsigned char *buf; 576 577 buf = src; 578 return ((uint32_t)buf[0] << 24) 579 | ((uint32_t)buf[1] << 16) 580 | ((uint32_t)buf[2] << 8) 581 | (uint32_t)buf[3]; 582#endif 583} 584 585static inline void 586br_enc64le(void *dst, uint64_t x) 587{ 588#if BR_LE_UNALIGNED 589 ((br_union_u64 *)dst)->u = x; 590#else 591 unsigned char *buf; 592 593 buf = dst; 594 br_enc32le(buf, (uint32_t)x); 595 br_enc32le(buf + 4, (uint32_t)(x >> 32)); 596#endif 597} 598 599static inline void 600br_enc64be(void *dst, uint64_t x) 601{ 602#if BR_BE_UNALIGNED 603 ((br_union_u64 *)dst)->u = x; 604#else 605 unsigned char *buf; 606 607 buf = dst; 608 br_enc32be(buf, (uint32_t)(x >> 32)); 609 br_enc32be(buf + 4, (uint32_t)x); 610#endif 611} 612 613static inline uint64_t 614br_dec64le(const void *src) 615{ 616#if BR_LE_UNALIGNED 617 return ((const br_union_u64 *)src)->u; 618#else 619 const unsigned char *buf; 620 621 buf = src; 622 return (uint64_t)br_dec32le(buf) 623 | ((uint64_t)br_dec32le(buf + 4) << 32); 624#endif 625} 626 627static inline uint64_t 628br_dec64be(const void *src) 629{ 630#if BR_BE_UNALIGNED 631 return ((const br_union_u64 *)src)->u; 632#else 633 const unsigned char *buf; 634 635 buf = src; 636 return ((uint64_t)br_dec32be(buf) << 32) 637 | (uint64_t)br_dec32be(buf + 4); 638#endif 639} 640 641/* 642 * Range decoding and encoding (for several successive values). 643 */ 644void br_range_dec16le(uint16_t *v, size_t num, const void *src); 645void br_range_dec16be(uint16_t *v, size_t num, const void *src); 646void br_range_enc16le(void *dst, const uint16_t *v, size_t num); 647void br_range_enc16be(void *dst, const uint16_t *v, size_t num); 648 649void br_range_dec32le(uint32_t *v, size_t num, const void *src); 650void br_range_dec32be(uint32_t *v, size_t num, const void *src); 651void br_range_enc32le(void *dst, const uint32_t *v, size_t num); 652void br_range_enc32be(void *dst, const uint32_t *v, size_t num); 653 654void br_range_dec64le(uint64_t *v, size_t num, const void *src); 655void br_range_dec64be(uint64_t *v, size_t num, const void *src); 656void br_range_enc64le(void *dst, const uint64_t *v, size_t num); 657void br_range_enc64be(void *dst, const uint64_t *v, size_t num); 658 659/* 660 * Byte-swap a 32-bit integer. 661 */ 662static inline uint32_t 663br_swap32(uint32_t x) 664{ 665 x = ((x & (uint32_t)0x00FF00FF) << 8) 666 | ((x >> 8) & (uint32_t)0x00FF00FF); 667 return (x << 16) | (x >> 16); 668} 669 670/* ==================================================================== */ 671/* 672 * Support code for hash functions. 673 */ 674 675/* 676 * IV for MD5, SHA-1, SHA-224 and SHA-256. 677 */ 678extern const uint32_t br_md5_IV[]; 679extern const uint32_t br_sha1_IV[]; 680extern const uint32_t br_sha224_IV[]; 681extern const uint32_t br_sha256_IV[]; 682 683/* 684 * Round functions for MD5, SHA-1, SHA-224 and SHA-256 (SHA-224 and 685 * SHA-256 use the same round function). 686 */ 687void br_md5_round(const unsigned char *buf, uint32_t *val); 688void br_sha1_round(const unsigned char *buf, uint32_t *val); 689void br_sha2small_round(const unsigned char *buf, uint32_t *val); 690 691/* 692 * The core function for the TLS PRF. It computes 693 * P_hash(secret, label + seed), and XORs the result into the dst buffer. 694 */ 695void br_tls_phash(void *dst, size_t len, 696 const br_hash_class *dig, 697 const void *secret, size_t secret_len, const char *label, 698 size_t seed_num, const br_tls_prf_seed_chunk *seed); 699 700/* 701 * Copy all configured hash implementations from a multihash context 702 * to another. 703 */ 704static inline void 705br_multihash_copyimpl(br_multihash_context *dst, 706 const br_multihash_context *src) 707{ 708 memcpy((void *)dst->impl, src->impl, sizeof src->impl); 709} 710 711/* ==================================================================== */ 712/* 713 * Constant-time primitives. These functions manipulate 32-bit values in 714 * order to provide constant-time comparisons and multiplexers. 715 * 716 * Boolean values (the "ctl" bits) MUST have value 0 or 1. 717 * 718 * Implementation notes: 719 * ===================== 720 * 721 * The uintN_t types are unsigned and with width exactly N bits; the C 722 * standard guarantees that computations are performed modulo 2^N, and 723 * there can be no overflow. Negation (unary '-') works on unsigned types 724 * as well. 725 * 726 * The intN_t types are guaranteed to have width exactly N bits, with no 727 * padding bit, and using two's complement representation. Casting 728 * intN_t to uintN_t really is conversion modulo 2^N. Beware that intN_t 729 * types, being signed, trigger implementation-defined behaviour on 730 * overflow (including raising some signal): with GCC, while modular 731 * arithmetics are usually applied, the optimizer may assume that 732 * overflows don't occur (unless the -fwrapv command-line option is 733 * added); Clang has the additional -ftrapv option to explicitly trap on 734 * integer overflow or underflow. 735 */ 736 737/* 738 * Negate a boolean. 739 */ 740static inline uint32_t 741NOT(uint32_t ctl) 742{ 743 return ctl ^ 1; 744} 745 746/* 747 * Multiplexer: returns x if ctl == 1, y if ctl == 0. 748 */ 749static inline uint32_t 750MUX(uint32_t ctl, uint32_t x, uint32_t y) 751{ 752 return y ^ (-ctl & (x ^ y)); 753} 754 755/* 756 * Equality check: returns 1 if x == y, 0 otherwise. 757 */ 758static inline uint32_t 759EQ(uint32_t x, uint32_t y) 760{ 761 uint32_t q; 762 763 q = x ^ y; 764 return NOT((q | -q) >> 31); 765} 766 767/* 768 * Inequality check: returns 1 if x != y, 0 otherwise. 769 */ 770static inline uint32_t 771NEQ(uint32_t x, uint32_t y) 772{ 773 uint32_t q; 774 775 q = x ^ y; 776 return (q | -q) >> 31; 777} 778 779/* 780 * Comparison: returns 1 if x > y, 0 otherwise. 781 */ 782static inline uint32_t 783GT(uint32_t x, uint32_t y) 784{ 785 /* 786 * If both x < 2^31 and x < 2^31, then y-x will have its high 787 * bit set if x > y, cleared otherwise. 788 * 789 * If either x >= 2^31 or y >= 2^31 (but not both), then the 790 * result is the high bit of x. 791 * 792 * If both x >= 2^31 and y >= 2^31, then we can virtually 793 * subtract 2^31 from both, and we are back to the first case. 794 * Since (y-2^31)-(x-2^31) = y-x, the subtraction is already 795 * fine. 796 */ 797 uint32_t z; 798 799 z = y - x; 800 return (z ^ ((x ^ y) & (x ^ z))) >> 31; 801} 802 803/* 804 * Other comparisons (greater-or-equal, lower-than, lower-or-equal). 805 */ 806#define GE(x, y) NOT(GT(y, x)) 807#define LT(x, y) GT(y, x) 808#define LE(x, y) NOT(GT(x, y)) 809 810/* 811 * General comparison: returned value is -1, 0 or 1, depending on 812 * whether x is lower than, equal to, or greater than y. 813 */ 814static inline int32_t 815CMP(uint32_t x, uint32_t y) 816{ 817 return (int32_t)GT(x, y) | -(int32_t)GT(y, x); 818} 819 820/* 821 * Returns 1 if x == 0, 0 otherwise. Take care that the operand is signed. 822 */ 823static inline uint32_t 824EQ0(int32_t x) 825{ 826 uint32_t q; 827 828 q = (uint32_t)x; 829 return ~(q | -q) >> 31; 830} 831 832/* 833 * Returns 1 if x > 0, 0 otherwise. Take care that the operand is signed. 834 */ 835static inline uint32_t 836GT0(int32_t x) 837{ 838 /* 839 * High bit of -x is 0 if x == 0, but 1 if x > 0. 840 */ 841 uint32_t q; 842 843 q = (uint32_t)x; 844 return (~q & -q) >> 31; 845} 846 847/* 848 * Returns 1 if x >= 0, 0 otherwise. Take care that the operand is signed. 849 */ 850static inline uint32_t 851GE0(int32_t x) 852{ 853 return ~(uint32_t)x >> 31; 854} 855 856/* 857 * Returns 1 if x < 0, 0 otherwise. Take care that the operand is signed. 858 */ 859static inline uint32_t 860LT0(int32_t x) 861{ 862 return (uint32_t)x >> 31; 863} 864 865/* 866 * Returns 1 if x <= 0, 0 otherwise. Take care that the operand is signed. 867 */ 868static inline uint32_t 869LE0(int32_t x) 870{ 871 uint32_t q; 872 873 /* 874 * ~-x has its high bit set if and only if -x is nonnegative (as 875 * a signed int), i.e. x is in the -(2^31-1) to 0 range. We must 876 * do an OR with x itself to account for x = -2^31. 877 */ 878 q = (uint32_t)x; 879 return (q | ~-q) >> 31; 880} 881 882/* 883 * Conditional copy: src[] is copied into dst[] if and only if ctl is 1. 884 * dst[] and src[] may overlap completely (but not partially). 885 */ 886void br_ccopy(uint32_t ctl, void *dst, const void *src, size_t len); 887 888#define CCOPY br_ccopy 889 890/* 891 * Compute the bit length of a 32-bit integer. Returned value is between 0 892 * and 32 (inclusive). 893 */ 894static inline uint32_t 895BIT_LENGTH(uint32_t x) 896{ 897 uint32_t k, c; 898 899 k = NEQ(x, 0); 900 c = GT(x, 0xFFFF); x = MUX(c, x >> 16, x); k += c << 4; 901 c = GT(x, 0x00FF); x = MUX(c, x >> 8, x); k += c << 3; 902 c = GT(x, 0x000F); x = MUX(c, x >> 4, x); k += c << 2; 903 c = GT(x, 0x0003); x = MUX(c, x >> 2, x); k += c << 1; 904 k += GT(x, 0x0001); 905 return k; 906} 907 908/* 909 * Compute the minimum of x and y. 910 */ 911static inline uint32_t 912MIN(uint32_t x, uint32_t y) 913{ 914 return MUX(GT(x, y), y, x); 915} 916 917/* 918 * Compute the maximum of x and y. 919 */ 920static inline uint32_t 921MAX(uint32_t x, uint32_t y) 922{ 923 return MUX(GT(x, y), x, y); 924} 925 926/* 927 * Multiply two 32-bit integers, with a 64-bit result. This default 928 * implementation assumes that the basic multiplication operator 929 * yields constant-time code. 930 */ 931#define MUL(x, y) ((uint64_t)(x) * (uint64_t)(y)) 932 933#if BR_CT_MUL31 934 935/* 936 * Alternate implementation of MUL31, that will be constant-time on some 937 * (old) platforms where the default MUL31 is not. Unfortunately, it is 938 * also substantially slower, and yields larger code, on more modern 939 * platforms, which is why it is deactivated by default. 940 * 941 * MUL31_lo() must do some extra work because on some platforms, the 942 * _signed_ multiplication may return early if the top bits are 1. 943 * Simply truncating (casting) the output of MUL31() would not be 944 * sufficient, because the compiler may notice that we keep only the low 945 * word, and then replace automatically the unsigned multiplication with 946 * a signed multiplication opcode. 947 */ 948#define MUL31(x, y) ((uint64_t)((x) | (uint32_t)0x80000000) \ 949 * (uint64_t)((y) | (uint32_t)0x80000000) \ 950 - ((uint64_t)(x) << 31) - ((uint64_t)(y) << 31) \ 951 - ((uint64_t)1 << 62)) 952static inline uint32_t 953MUL31_lo(uint32_t x, uint32_t y) 954{ 955 uint32_t xl, xh; 956 uint32_t yl, yh; 957 958 xl = (x & 0xFFFF) | (uint32_t)0x80000000; 959 xh = (x >> 16) | (uint32_t)0x80000000; 960 yl = (y & 0xFFFF) | (uint32_t)0x80000000; 961 yh = (y >> 16) | (uint32_t)0x80000000; 962 return (xl * yl + ((xl * yh + xh * yl) << 16)) & (uint32_t)0x7FFFFFFF; 963} 964 965#else 966 967/* 968 * Multiply two 31-bit integers, with a 62-bit result. This default 969 * implementation assumes that the basic multiplication operator 970 * yields constant-time code. 971 * The MUL31_lo() macro returns only the low 31 bits of the product. 972 */ 973#define MUL31(x, y) ((uint64_t)(x) * (uint64_t)(y)) 974#define MUL31_lo(x, y) (((uint32_t)(x) * (uint32_t)(y)) & (uint32_t)0x7FFFFFFF) 975 976#endif 977 978/* 979 * Multiply two words together; the sum of the lengths of the two 980 * operands must not exceed 31 (for instance, one operand may use 16 981 * bits if the other fits on 15). If BR_CT_MUL15 is non-zero, then the 982 * macro will contain some extra operations that help in making the 983 * operation constant-time on some platforms, where the basic 32-bit 984 * multiplication is not constant-time. 985 */ 986#if BR_CT_MUL15 987#define MUL15(x, y) (((uint32_t)(x) | (uint32_t)0x80000000) \ 988 * ((uint32_t)(y) | (uint32_t)0x80000000) \ 989 & (uint32_t)0x7FFFFFFF) 990#else 991#define MUL15(x, y) ((uint32_t)(x) * (uint32_t)(y)) 992#endif 993 994/* 995 * Arithmetic right shift (sign bit is copied). What happens when 996 * right-shifting a negative value is _implementation-defined_, so it 997 * does not trigger undefined behaviour, but it is still up to each 998 * compiler to define (and document) what it does. Most/all compilers 999 * will do an arithmetic shift, the sign bit being used to fill the 1000 * holes; this is a native operation on the underlying CPU, and it would 1001 * make little sense for the compiler to do otherwise. GCC explicitly 1002 * documents that it follows that convention. 1003 * 1004 * Still, if BR_NO_ARITH_SHIFT is defined (and non-zero), then an 1005 * alternate version will be used, that does not rely on such 1006 * implementation-defined behaviour. Unfortunately, it is also slower 1007 * and yields bigger code, which is why it is deactivated by default. 1008 */ 1009#if BR_NO_ARITH_SHIFT 1010#define ARSH(x, n) (((uint32_t)(x) >> (n)) \ 1011 | ((-((uint32_t)(x) >> 31)) << (32 - (n)))) 1012#else 1013#define ARSH(x, n) ((*(int32_t *)&(x)) >> (n)) 1014#endif 1015 1016/* 1017 * Constant-time division. The dividend hi:lo is divided by the 1018 * divisor d; the quotient is returned and the remainder is written 1019 * in *r. If hi == d, then the quotient does not fit on 32 bits; 1020 * returned value is thus truncated. If hi > d, returned values are 1021 * indeterminate. 1022 */ 1023uint32_t br_divrem(uint32_t hi, uint32_t lo, uint32_t d, uint32_t *r); 1024 1025/* 1026 * Wrapper for br_divrem(); the remainder is returned, and the quotient 1027 * is discarded. 1028 */ 1029static inline uint32_t 1030br_rem(uint32_t hi, uint32_t lo, uint32_t d) 1031{ 1032 uint32_t r; 1033 1034 br_divrem(hi, lo, d, &r); 1035 return r; 1036} 1037 1038/* 1039 * Wrapper for br_divrem(); the quotient is returned, and the remainder 1040 * is discarded. 1041 */ 1042static inline uint32_t 1043br_div(uint32_t hi, uint32_t lo, uint32_t d) 1044{ 1045 uint32_t r; 1046 1047 return br_divrem(hi, lo, d, &r); 1048} 1049 1050/* ==================================================================== */ 1051 1052/* 1053 * Integers 'i32' 1054 * -------------- 1055 * 1056 * The 'i32' functions implement computations on big integers using 1057 * an internal representation as an array of 32-bit integers. For 1058 * an array x[]: 1059 * -- x[0] contains the "announced bit length" of the integer 1060 * -- x[1], x[2]... contain the value in little-endian order (x[1] 1061 * contains the least significant 32 bits) 1062 * 1063 * Multiplications rely on the elementary 32x32->64 multiplication. 1064 * 1065 * The announced bit length specifies the number of bits that are 1066 * significant in the subsequent 32-bit words. Unused bits in the 1067 * last (most significant) word are set to 0; subsequent words are 1068 * uninitialized and need not exist at all. 1069 * 1070 * The execution time and memory access patterns of all computations 1071 * depend on the announced bit length, but not on the actual word 1072 * values. For modular integers, the announced bit length of any integer 1073 * modulo n is equal to the actual bit length of n; thus, computations 1074 * on modular integers are "constant-time" (only the modulus length may 1075 * leak). 1076 */ 1077 1078/* 1079 * Compute the actual bit length of an integer. The argument x should 1080 * point to the first (least significant) value word of the integer. 1081 * The len 'xlen' contains the number of 32-bit words to access. 1082 * 1083 * CT: value or length of x does not leak. 1084 */ 1085uint32_t br_i32_bit_length(uint32_t *x, size_t xlen); 1086 1087/* 1088 * Decode an integer from its big-endian unsigned representation. The 1089 * "true" bit length of the integer is computed, but all words of x[] 1090 * corresponding to the full 'len' bytes of the source are set. 1091 * 1092 * CT: value or length of x does not leak. 1093 */ 1094void br_i32_decode(uint32_t *x, const void *src, size_t len); 1095 1096/* 1097 * Decode an integer from its big-endian unsigned representation. The 1098 * integer MUST be lower than m[]; the announced bit length written in 1099 * x[] will be equal to that of m[]. All 'len' bytes from the source are 1100 * read. 1101 * 1102 * Returned value is 1 if the decode value fits within the modulus, 0 1103 * otherwise. In the latter case, the x[] buffer will be set to 0 (but 1104 * still with the announced bit length of m[]). 1105 * 1106 * CT: value or length of x does not leak. Memory access pattern depends 1107 * only of 'len' and the announced bit length of m. Whether x fits or 1108 * not does not leak either. 1109 */ 1110uint32_t br_i32_decode_mod(uint32_t *x, 1111 const void *src, size_t len, const uint32_t *m); 1112 1113/* 1114 * Reduce an integer (a[]) modulo another (m[]). The result is written 1115 * in x[] and its announced bit length is set to be equal to that of m[]. 1116 * 1117 * x[] MUST be distinct from a[] and m[]. 1118 * 1119 * CT: only announced bit lengths leak, not values of x, a or m. 1120 */ 1121void br_i32_reduce(uint32_t *x, const uint32_t *a, const uint32_t *m); 1122 1123/* 1124 * Decode an integer from its big-endian unsigned representation, and 1125 * reduce it modulo the provided modulus m[]. The announced bit length 1126 * of the result is set to be equal to that of the modulus. 1127 * 1128 * x[] MUST be distinct from m[]. 1129 */ 1130void br_i32_decode_reduce(uint32_t *x, 1131 const void *src, size_t len, const uint32_t *m); 1132 1133/* 1134 * Encode an integer into its big-endian unsigned representation. The 1135 * output length in bytes is provided (parameter 'len'); if the length 1136 * is too short then the integer is appropriately truncated; if it is 1137 * too long then the extra bytes are set to 0. 1138 */ 1139void br_i32_encode(void *dst, size_t len, const uint32_t *x); 1140 1141/* 1142 * Multiply x[] by 2^32 and then add integer z, modulo m[]. This 1143 * function assumes that x[] and m[] have the same announced bit 1144 * length, and the announced bit length of m[] matches its true 1145 * bit length. 1146 * 1147 * x[] and m[] MUST be distinct arrays. 1148 * 1149 * CT: only the common announced bit length of x and m leaks, not 1150 * the values of x, z or m. 1151 */ 1152void br_i32_muladd_small(uint32_t *x, uint32_t z, const uint32_t *m); 1153 1154/* 1155 * Extract one word from an integer. The offset is counted in bits. 1156 * The word MUST entirely fit within the word elements corresponding 1157 * to the announced bit length of a[]. 1158 */ 1159static inline uint32_t 1160br_i32_word(const uint32_t *a, uint32_t off) 1161{ 1162 size_t u; 1163 unsigned j; 1164 1165 u = (size_t)(off >> 5) + 1; 1166 j = (unsigned)off & 31; 1167 if (j == 0) { 1168 return a[u]; 1169 } else { 1170 return (a[u] >> j) | (a[u + 1] << (32 - j)); 1171 } 1172} 1173 1174/* 1175 * Test whether an integer is zero. 1176 */ 1177uint32_t br_i32_iszero(const uint32_t *x); 1178 1179/* 1180 * Add b[] to a[] and return the carry (0 or 1). If ctl is 0, then a[] 1181 * is unmodified, but the carry is still computed and returned. The 1182 * arrays a[] and b[] MUST have the same announced bit length. 1183 * 1184 * a[] and b[] MAY be the same array, but partial overlap is not allowed. 1185 */ 1186uint32_t br_i32_add(uint32_t *a, const uint32_t *b, uint32_t ctl); 1187 1188/* 1189 * Subtract b[] from a[] and return the carry (0 or 1). If ctl is 0, 1190 * then a[] is unmodified, but the carry is still computed and returned. 1191 * The arrays a[] and b[] MUST have the same announced bit length. 1192 * 1193 * a[] and b[] MAY be the same array, but partial overlap is not allowed. 1194 */ 1195uint32_t br_i32_sub(uint32_t *a, const uint32_t *b, uint32_t ctl); 1196 1197/* 1198 * Compute d+a*b, result in d. The initial announced bit length of d[] 1199 * MUST match that of a[]. The d[] array MUST be large enough to 1200 * accommodate the full result, plus (possibly) an extra word. The 1201 * resulting announced bit length of d[] will be the sum of the announced 1202 * bit lengths of a[] and b[] (therefore, it may be larger than the actual 1203 * bit length of the numerical result). 1204 * 1205 * a[] and b[] may be the same array. d[] must be disjoint from both a[] 1206 * and b[]. 1207 */ 1208void br_i32_mulacc(uint32_t *d, const uint32_t *a, const uint32_t *b); 1209 1210/* 1211 * Zeroize an integer. The announced bit length is set to the provided 1212 * value, and the corresponding words are set to 0. 1213 */ 1214static inline void 1215br_i32_zero(uint32_t *x, uint32_t bit_len) 1216{ 1217 *x ++ = bit_len; 1218 memset(x, 0, ((bit_len + 31) >> 5) * sizeof *x); 1219} 1220 1221/* 1222 * Compute -(1/x) mod 2^32. If x is even, then this function returns 0. 1223 */ 1224uint32_t br_i32_ninv32(uint32_t x); 1225 1226/* 1227 * Convert a modular integer to Montgomery representation. The integer x[] 1228 * MUST be lower than m[], but with the same announced bit length. 1229 */ 1230void br_i32_to_monty(uint32_t *x, const uint32_t *m); 1231 1232/* 1233 * Convert a modular integer back from Montgomery representation. The 1234 * integer x[] MUST be lower than m[], but with the same announced bit 1235 * length. The "m0i" parameter is equal to -(1/m0) mod 2^32, where m0 is 1236 * the least significant value word of m[] (this works only if m[] is 1237 * an odd integer). 1238 */ 1239void br_i32_from_monty(uint32_t *x, const uint32_t *m, uint32_t m0i); 1240 1241/* 1242 * Compute a modular Montgomery multiplication. d[] is filled with the 1243 * value of x*y/R modulo m[] (where R is the Montgomery factor). The 1244 * array d[] MUST be distinct from x[], y[] and m[]. x[] and y[] MUST be 1245 * numerically lower than m[]. x[] and y[] MAY be the same array. The 1246 * "m0i" parameter is equal to -(1/m0) mod 2^32, where m0 is the least 1247 * significant value word of m[] (this works only if m[] is an odd 1248 * integer). 1249 */ 1250void br_i32_montymul(uint32_t *d, const uint32_t *x, const uint32_t *y, 1251 const uint32_t *m, uint32_t m0i); 1252 1253/* 1254 * Compute a modular exponentiation. x[] MUST be an integer modulo m[] 1255 * (same announced bit length, lower value). m[] MUST be odd. The 1256 * exponent is in big-endian unsigned notation, over 'elen' bytes. The 1257 * "m0i" parameter is equal to -(1/m0) mod 2^32, where m0 is the least 1258 * significant value word of m[] (this works only if m[] is an odd 1259 * integer). The t1[] and t2[] parameters must be temporary arrays, 1260 * each large enough to accommodate an integer with the same size as m[]. 1261 */ 1262void br_i32_modpow(uint32_t *x, const unsigned char *e, size_t elen, 1263 const uint32_t *m, uint32_t m0i, uint32_t *t1, uint32_t *t2); 1264 1265/* ==================================================================== */ 1266 1267/* 1268 * Integers 'i31' 1269 * -------------- 1270 * 1271 * The 'i31' functions implement computations on big integers using 1272 * an internal representation as an array of 32-bit integers. For 1273 * an array x[]: 1274 * -- x[0] encodes the array length and the "announced bit length" 1275 * of the integer: namely, if the announced bit length is k, 1276 * then x[0] = ((k / 31) << 5) + (k % 31). 1277 * -- x[1], x[2]... contain the value in little-endian order, 31 1278 * bits per word (x[1] contains the least significant 31 bits). 1279 * The upper bit of each word is 0. 1280 * 1281 * Multiplications rely on the elementary 32x32->64 multiplication. 1282 * 1283 * The announced bit length specifies the number of bits that are 1284 * significant in the subsequent 32-bit words. Unused bits in the 1285 * last (most significant) word are set to 0; subsequent words are 1286 * uninitialized and need not exist at all. 1287 * 1288 * The execution time and memory access patterns of all computations 1289 * depend on the announced bit length, but not on the actual word 1290 * values. For modular integers, the announced bit length of any integer 1291 * modulo n is equal to the actual bit length of n; thus, computations 1292 * on modular integers are "constant-time" (only the modulus length may 1293 * leak). 1294 */ 1295 1296/* 1297 * Test whether an integer is zero. 1298 */ 1299uint32_t br_i31_iszero(const uint32_t *x); 1300 1301/* 1302 * Add b[] to a[] and return the carry (0 or 1). If ctl is 0, then a[] 1303 * is unmodified, but the carry is still computed and returned. The 1304 * arrays a[] and b[] MUST have the same announced bit length. 1305 * 1306 * a[] and b[] MAY be the same array, but partial overlap is not allowed. 1307 */ 1308uint32_t br_i31_add(uint32_t *a, const uint32_t *b, uint32_t ctl); 1309 1310/* 1311 * Subtract b[] from a[] and return the carry (0 or 1). If ctl is 0, 1312 * then a[] is unmodified, but the carry is still computed and returned. 1313 * The arrays a[] and b[] MUST have the same announced bit length. 1314 * 1315 * a[] and b[] MAY be the same array, but partial overlap is not allowed. 1316 */ 1317uint32_t br_i31_sub(uint32_t *a, const uint32_t *b, uint32_t ctl); 1318 1319/* 1320 * Compute the ENCODED actual bit length of an integer. The argument x 1321 * should point to the first (least significant) value word of the 1322 * integer. The len 'xlen' contains the number of 32-bit words to 1323 * access. The upper bit of each value word MUST be 0. 1324 * Returned value is ((k / 31) << 5) + (k % 31) if the bit length is k. 1325 * 1326 * CT: value or length of x does not leak. 1327 */ 1328uint32_t br_i31_bit_length(uint32_t *x, size_t xlen); 1329 1330/* 1331 * Decode an integer from its big-endian unsigned representation. The 1332 * "true" bit length of the integer is computed and set in the encoded 1333 * announced bit length (x[0]), but all words of x[] corresponding to 1334 * the full 'len' bytes of the source are set. 1335 * 1336 * CT: value or length of x does not leak. 1337 */ 1338void br_i31_decode(uint32_t *x, const void *src, size_t len); 1339 1340/* 1341 * Decode an integer from its big-endian unsigned representation. The 1342 * integer MUST be lower than m[]; the (encoded) announced bit length 1343 * written in x[] will be equal to that of m[]. All 'len' bytes from the 1344 * source are read. 1345 * 1346 * Returned value is 1 if the decode value fits within the modulus, 0 1347 * otherwise. In the latter case, the x[] buffer will be set to 0 (but 1348 * still with the announced bit length of m[]). 1349 * 1350 * CT: value or length of x does not leak. Memory access pattern depends 1351 * only of 'len' and the announced bit length of m. Whether x fits or 1352 * not does not leak either. 1353 */ 1354uint32_t br_i31_decode_mod(uint32_t *x, 1355 const void *src, size_t len, const uint32_t *m); 1356 1357/* 1358 * Zeroize an integer. The announced bit length is set to the provided 1359 * value, and the corresponding words are set to 0. The ENCODED bit length 1360 * is expected here. 1361 */ 1362static inline void 1363br_i31_zero(uint32_t *x, uint32_t bit_len) 1364{ 1365 *x ++ = bit_len; 1366 memset(x, 0, ((bit_len + 31) >> 5) * sizeof *x); 1367} 1368 1369/* 1370 * Right-shift an integer. The shift amount must be lower than 31 1371 * bits. 1372 */ 1373void br_i31_rshift(uint32_t *x, int count); 1374 1375/* 1376 * Reduce an integer (a[]) modulo another (m[]). The result is written 1377 * in x[] and its announced bit length is set to be equal to that of m[]. 1378 * 1379 * x[] MUST be distinct from a[] and m[]. 1380 * 1381 * CT: only announced bit lengths leak, not values of x, a or m. 1382 */ 1383void br_i31_reduce(uint32_t *x, const uint32_t *a, const uint32_t *m); 1384 1385/* 1386 * Decode an integer from its big-endian unsigned representation, and 1387 * reduce it modulo the provided modulus m[]. The announced bit length 1388 * of the result is set to be equal to that of the modulus. 1389 * 1390 * x[] MUST be distinct from m[]. 1391 */ 1392void br_i31_decode_reduce(uint32_t *x, 1393 const void *src, size_t len, const uint32_t *m); 1394 1395/* 1396 * Multiply x[] by 2^31 and then add integer z, modulo m[]. This 1397 * function assumes that x[] and m[] have the same announced bit 1398 * length, the announced bit length of m[] matches its true 1399 * bit length. 1400 * 1401 * x[] and m[] MUST be distinct arrays. z MUST fit in 31 bits (upper 1402 * bit set to 0). 1403 * 1404 * CT: only the common announced bit length of x and m leaks, not 1405 * the values of x, z or m. 1406 */ 1407void br_i31_muladd_small(uint32_t *x, uint32_t z, const uint32_t *m); 1408 1409/* 1410 * Encode an integer into its big-endian unsigned representation. The 1411 * output length in bytes is provided (parameter 'len'); if the length 1412 * is too short then the integer is appropriately truncated; if it is 1413 * too long then the extra bytes are set to 0. 1414 */ 1415void br_i31_encode(void *dst, size_t len, const uint32_t *x); 1416 1417/* 1418 * Compute -(1/x) mod 2^31. If x is even, then this function returns 0. 1419 */ 1420uint32_t br_i31_ninv31(uint32_t x); 1421 1422/* 1423 * Compute a modular Montgomery multiplication. d[] is filled with the 1424 * value of x*y/R modulo m[] (where R is the Montgomery factor). The 1425 * array d[] MUST be distinct from x[], y[] and m[]. x[] and y[] MUST be 1426 * numerically lower than m[]. x[] and y[] MAY be the same array. The 1427 * "m0i" parameter is equal to -(1/m0) mod 2^31, where m0 is the least 1428 * significant value word of m[] (this works only if m[] is an odd 1429 * integer). 1430 */ 1431void br_i31_montymul(uint32_t *d, const uint32_t *x, const uint32_t *y, 1432 const uint32_t *m, uint32_t m0i); 1433 1434/* 1435 * Convert a modular integer to Montgomery representation. The integer x[] 1436 * MUST be lower than m[], but with the same announced bit length. 1437 */ 1438void br_i31_to_monty(uint32_t *x, const uint32_t *m); 1439 1440/* 1441 * Convert a modular integer back from Montgomery representation. The 1442 * integer x[] MUST be lower than m[], but with the same announced bit 1443 * length. The "m0i" parameter is equal to -(1/m0) mod 2^32, where m0 is 1444 * the least significant value word of m[] (this works only if m[] is 1445 * an odd integer). 1446 */ 1447void br_i31_from_monty(uint32_t *x, const uint32_t *m, uint32_t m0i); 1448 1449/* 1450 * Compute a modular exponentiation. x[] MUST be an integer modulo m[] 1451 * (same announced bit length, lower value). m[] MUST be odd. The 1452 * exponent is in big-endian unsigned notation, over 'elen' bytes. The 1453 * "m0i" parameter is equal to -(1/m0) mod 2^31, where m0 is the least 1454 * significant value word of m[] (this works only if m[] is an odd 1455 * integer). The t1[] and t2[] parameters must be temporary arrays, 1456 * each large enough to accommodate an integer with the same size as m[]. 1457 */ 1458void br_i31_modpow(uint32_t *x, const unsigned char *e, size_t elen, 1459 const uint32_t *m, uint32_t m0i, uint32_t *t1, uint32_t *t2); 1460 1461/* 1462 * Compute a modular exponentiation. x[] MUST be an integer modulo m[] 1463 * (same announced bit length, lower value). m[] MUST be odd. The 1464 * exponent is in big-endian unsigned notation, over 'elen' bytes. The 1465 * "m0i" parameter is equal to -(1/m0) mod 2^31, where m0 is the least 1466 * significant value word of m[] (this works only if m[] is an odd 1467 * integer). The tmp[] array is used for temporaries, and has size 1468 * 'twlen' words; it must be large enough to accommodate at least two 1469 * temporary values with the same size as m[] (including the leading 1470 * "bit length" word). If there is room for more temporaries, then this 1471 * function may use the extra room for window-based optimisation, 1472 * resulting in faster computations. 1473 * 1474 * Returned value is 1 on success, 0 on error. An error is reported if 1475 * the provided tmp[] array is too short. 1476 */ 1477uint32_t br_i31_modpow_opt(uint32_t *x, const unsigned char *e, size_t elen, 1478 const uint32_t *m, uint32_t m0i, uint32_t *tmp, size_t twlen); 1479 1480/* 1481 * Compute d+a*b, result in d. The initial announced bit length of d[] 1482 * MUST match that of a[]. The d[] array MUST be large enough to 1483 * accommodate the full result, plus (possibly) an extra word. The 1484 * resulting announced bit length of d[] will be the sum of the announced 1485 * bit lengths of a[] and b[] (therefore, it may be larger than the actual 1486 * bit length of the numerical result). 1487 * 1488 * a[] and b[] may be the same array. d[] must be disjoint from both a[] 1489 * and b[]. 1490 */ 1491void br_i31_mulacc(uint32_t *d, const uint32_t *a, const uint32_t *b); 1492 1493/* 1494 * Compute x/y mod m, result in x. Values x and y must be between 0 and 1495 * m-1, and have the same announced bit length as m. Modulus m must be 1496 * odd. The "m0i" parameter is equal to -1/m mod 2^31. The array 't' 1497 * must point to a temporary area that can hold at least three integers 1498 * of the size of m. 1499 * 1500 * m may not overlap x and y. x and y may overlap each other (this can 1501 * be useful to test whether a value is invertible modulo m). t must be 1502 * disjoint from all other arrays. 1503 * 1504 * Returned value is 1 on success, 0 otherwise. Success is attained if 1505 * y is invertible modulo m. 1506 */ 1507uint32_t br_i31_moddiv(uint32_t *x, const uint32_t *y, 1508 const uint32_t *m, uint32_t m0i, uint32_t *t); 1509 1510/* ==================================================================== */ 1511 1512/* 1513 * FIXME: document "i15" functions. 1514 */ 1515 1516static inline void 1517br_i15_zero(uint16_t *x, uint16_t bit_len) 1518{ 1519 *x ++ = bit_len; 1520 memset(x, 0, ((bit_len + 15) >> 4) * sizeof *x); 1521} 1522 1523uint32_t br_i15_iszero(const uint16_t *x); 1524 1525uint16_t br_i15_ninv15(uint16_t x); 1526 1527uint32_t br_i15_add(uint16_t *a, const uint16_t *b, uint32_t ctl); 1528 1529uint32_t br_i15_sub(uint16_t *a, const uint16_t *b, uint32_t ctl); 1530 1531void br_i15_muladd_small(uint16_t *x, uint16_t z, const uint16_t *m); 1532 1533void br_i15_montymul(uint16_t *d, const uint16_t *x, const uint16_t *y, 1534 const uint16_t *m, uint16_t m0i); 1535 1536void br_i15_to_monty(uint16_t *x, const uint16_t *m); 1537 1538void br_i15_modpow(uint16_t *x, const unsigned char *e, size_t elen, 1539 const uint16_t *m, uint16_t m0i, uint16_t *t1, uint16_t *t2); 1540 1541uint32_t br_i15_modpow_opt(uint16_t *x, const unsigned char *e, size_t elen, 1542 const uint16_t *m, uint16_t m0i, uint16_t *tmp, size_t twlen); 1543 1544void br_i15_encode(void *dst, size_t len, const uint16_t *x); 1545 1546uint32_t br_i15_decode_mod(uint16_t *x, 1547 const void *src, size_t len, const uint16_t *m); 1548 1549void br_i15_rshift(uint16_t *x, int count); 1550 1551uint32_t br_i15_bit_length(uint16_t *x, size_t xlen); 1552 1553void br_i15_decode(uint16_t *x, const void *src, size_t len); 1554 1555void br_i15_from_monty(uint16_t *x, const uint16_t *m, uint16_t m0i); 1556 1557void br_i15_decode_reduce(uint16_t *x, 1558 const void *src, size_t len, const uint16_t *m); 1559 1560void br_i15_reduce(uint16_t *x, const uint16_t *a, const uint16_t *m); 1561 1562void br_i15_mulacc(uint16_t *d, const uint16_t *a, const uint16_t *b); 1563 1564uint32_t br_i15_moddiv(uint16_t *x, const uint16_t *y, 1565 const uint16_t *m, uint16_t m0i, uint16_t *t); 1566 1567/* 1568 * Variant of br_i31_modpow_opt() that internally uses 64x64->128 1569 * multiplications. It expects the same parameters as br_i31_modpow_opt(), 1570 * except that the temporaries should be 64-bit integers, not 32-bit 1571 * integers. 1572 */ 1573uint32_t br_i62_modpow_opt(uint32_t *x31, const unsigned char *e, size_t elen, 1574 const uint32_t *m31, uint32_t m0i31, uint64_t *tmp, size_t twlen); 1575 1576/* 1577 * Type for a function with the same API as br_i31_modpow_opt() (some 1578 * implementations of this type may have stricter alignment requirements 1579 * on the temporaries). 1580 */ 1581typedef uint32_t (*br_i31_modpow_opt_type)(uint32_t *x, 1582 const unsigned char *e, size_t elen, 1583 const uint32_t *m, uint32_t m0i, uint32_t *tmp, size_t twlen); 1584 1585/* 1586 * Wrapper for br_i62_modpow_opt() that uses the same type as 1587 * br_i31_modpow_opt(); however, it requires its 'tmp' argument to the 1588 * 64-bit aligned. 1589 */ 1590uint32_t br_i62_modpow_opt_as_i31(uint32_t *x, 1591 const unsigned char *e, size_t elen, 1592 const uint32_t *m, uint32_t m0i, uint32_t *tmp, size_t twlen); 1593 1594/* ==================================================================== */ 1595 1596static inline size_t 1597br_digest_size(const br_hash_class *digest_class) 1598{ 1599 return (size_t)(digest_class->desc >> BR_HASHDESC_OUT_OFF) 1600 & BR_HASHDESC_OUT_MASK; 1601} 1602 1603/* 1604 * Get the output size (in bytes) of a hash function. 1605 */ 1606size_t br_digest_size_by_ID(int digest_id); 1607 1608/* 1609 * Get the OID (encoded OBJECT IDENTIFIER value, without tag and length) 1610 * for a hash function. If digest_id is not a supported digest identifier 1611 * (in particular if it is equal to 0, i.e. br_md5sha1_ID), then NULL is 1612 * returned and *len is set to 0. 1613 */ 1614const unsigned char *br_digest_OID(int digest_id, size_t *len); 1615 1616/* ==================================================================== */ 1617/* 1618 * DES support functions. 1619 */ 1620 1621/* 1622 * Apply DES Initial Permutation. 1623 */ 1624void br_des_do_IP(uint32_t *xl, uint32_t *xr); 1625 1626/* 1627 * Apply DES Final Permutation (inverse of IP). 1628 */ 1629void br_des_do_invIP(uint32_t *xl, uint32_t *xr); 1630 1631/* 1632 * Key schedule unit: for a DES key (8 bytes), compute 16 subkeys. Each 1633 * subkey is two 28-bit words represented as two 32-bit words; the PC-2 1634 * bit extration is NOT applied. 1635 */ 1636void br_des_keysched_unit(uint32_t *skey, const void *key); 1637 1638/* 1639 * Reversal of 16 DES sub-keys (for decryption). 1640 */ 1641void br_des_rev_skey(uint32_t *skey); 1642 1643/* 1644 * DES/3DES key schedule for 'des_tab' (encryption direction). Returned 1645 * value is the number of rounds. 1646 */ 1647unsigned br_des_tab_keysched(uint32_t *skey, const void *key, size_t key_len); 1648 1649/* 1650 * DES/3DES key schedule for 'des_ct' (encryption direction). Returned 1651 * value is the number of rounds. 1652 */ 1653unsigned br_des_ct_keysched(uint32_t *skey, const void *key, size_t key_len); 1654 1655/* 1656 * DES/3DES subkey decompression (from the compressed bitsliced subkeys). 1657 */ 1658void br_des_ct_skey_expand(uint32_t *sk_exp, 1659 unsigned num_rounds, const uint32_t *skey); 1660 1661/* 1662 * DES/3DES block encryption/decryption ('des_tab'). 1663 */ 1664void br_des_tab_process_block(unsigned num_rounds, 1665 const uint32_t *skey, void *block); 1666 1667/* 1668 * DES/3DES block encryption/decryption ('des_ct'). 1669 */ 1670void br_des_ct_process_block(unsigned num_rounds, 1671 const uint32_t *skey, void *block); 1672 1673/* ==================================================================== */ 1674/* 1675 * AES support functions. 1676 */ 1677 1678/* 1679 * The AES S-box (256-byte table). 1680 */ 1681extern const unsigned char br_aes_S[]; 1682 1683/* 1684 * AES key schedule. skey[] is filled with n+1 128-bit subkeys, where n 1685 * is the number of rounds (10 to 14, depending on key size). The number 1686 * of rounds is returned. If the key size is invalid (not 16, 24 or 32), 1687 * then 0 is returned. 1688 * 1689 * This implementation uses a 256-byte table and is NOT constant-time. 1690 */ 1691unsigned br_aes_keysched(uint32_t *skey, const void *key, size_t key_len); 1692 1693/* 1694 * AES key schedule for decryption ('aes_big' implementation). 1695 */ 1696unsigned br_aes_big_keysched_inv(uint32_t *skey, 1697 const void *key, size_t key_len); 1698 1699/* 1700 * AES block encryption with the 'aes_big' implementation (fast, but 1701 * not constant-time). This function encrypts a single block "in place". 1702 */ 1703void br_aes_big_encrypt(unsigned num_rounds, const uint32_t *skey, void *data); 1704 1705/* 1706 * AES block decryption with the 'aes_big' implementation (fast, but 1707 * not constant-time). This function decrypts a single block "in place". 1708 */ 1709void br_aes_big_decrypt(unsigned num_rounds, const uint32_t *skey, void *data); 1710 1711/* 1712 * AES block encryption with the 'aes_small' implementation (small, but 1713 * slow and not constant-time). This function encrypts a single block 1714 * "in place". 1715 */ 1716void br_aes_small_encrypt(unsigned num_rounds, 1717 const uint32_t *skey, void *data); 1718 1719/* 1720 * AES block decryption with the 'aes_small' implementation (small, but 1721 * slow and not constant-time). This function decrypts a single block 1722 * "in place". 1723 */ 1724void br_aes_small_decrypt(unsigned num_rounds, 1725 const uint32_t *skey, void *data); 1726 1727/* 1728 * The constant-time implementation is "bitsliced": the 128-bit state is 1729 * split over eight 32-bit words q* in the following way: 1730 * 1731 * -- Input block consists in 16 bytes: 1732 * a00 a10 a20 a30 a01 a11 a21 a31 a02 a12 a22 a32 a03 a13 a23 a33 1733 * In the terminology of FIPS 197, this is a 4x4 matrix which is read 1734 * column by column. 1735 * 1736 * -- Each byte is split into eight bits which are distributed over the 1737 * eight words, at the same rank. Thus, for a byte x at rank k, bit 0 1738 * (least significant) of x will be at rank k in q0 (if that bit is b, 1739 * then it contributes "b << k" to the value of q0), bit 1 of x will be 1740 * at rank k in q1, and so on. 1741 * 1742 * -- Ranks given to bits are in "row order" and are either all even, or 1743 * all odd. Two independent AES states are thus interleaved, one using 1744 * the even ranks, the other the odd ranks. Row order means: 1745 * a00 a01 a02 a03 a10 a11 a12 a13 a20 a21 a22 a23 a30 a31 a32 a33 1746 * 1747 * Converting input bytes from two AES blocks to bitslice representation 1748 * is done in the following way: 1749 * -- Decode first block into the four words q0 q2 q4 q6, in that order, 1750 * using little-endian convention. 1751 * -- Decode second block into the four words q1 q3 q5 q7, in that order, 1752 * using little-endian convention. 1753 * -- Call br_aes_ct_ortho(). 1754 * 1755 * Converting back to bytes is done by using the reverse operations. Note 1756 * that br_aes_ct_ortho() is its own inverse. 1757 */ 1758 1759/* 1760 * Perform bytewise orthogonalization of eight 32-bit words. Bytes 1761 * of q0..q7 are spread over all words: for a byte x that occurs 1762 * at rank i in q[j] (byte x uses bits 8*i to 8*i+7 in q[j]), the bit 1763 * of rank k in x (0 <= k <= 7) goes to q[k] at rank 8*i+j. 1764 * 1765 * This operation is an involution. 1766 */ 1767void br_aes_ct_ortho(uint32_t *q); 1768 1769/* 1770 * The AES S-box, as a bitsliced constant-time version. The input array 1771 * consists in eight 32-bit words; 32 S-box instances are computed in 1772 * parallel. Bits 0 to 7 of each S-box input (bit 0 is least significant) 1773 * are spread over the words 0 to 7, at the same rank. 1774 */ 1775void br_aes_ct_bitslice_Sbox(uint32_t *q); 1776 1777/* 1778 * Like br_aes_bitslice_Sbox(), but for the inverse S-box. 1779 */ 1780void br_aes_ct_bitslice_invSbox(uint32_t *q); 1781 1782/* 1783 * Compute AES encryption on bitsliced data. Since input is stored on 1784 * eight 32-bit words, two block encryptions are actually performed 1785 * in parallel. 1786 */ 1787void br_aes_ct_bitslice_encrypt(unsigned num_rounds, 1788 const uint32_t *skey, uint32_t *q); 1789 1790/* 1791 * Compute AES decryption on bitsliced data. Since input is stored on 1792 * eight 32-bit words, two block decryptions are actually performed 1793 * in parallel. 1794 */ 1795void br_aes_ct_bitslice_decrypt(unsigned num_rounds, 1796 const uint32_t *skey, uint32_t *q); 1797 1798/* 1799 * AES key schedule, constant-time version. skey[] is filled with n+1 1800 * 128-bit subkeys, where n is the number of rounds (10 to 14, depending 1801 * on key size). The number of rounds is returned. If the key size is 1802 * invalid (not 16, 24 or 32), then 0 is returned. 1803 */ 1804unsigned br_aes_ct_keysched(uint32_t *comp_skey, 1805 const void *key, size_t key_len); 1806 1807/* 1808 * Expand AES subkeys as produced by br_aes_ct_keysched(), into 1809 * a larger array suitable for br_aes_ct_bitslice_encrypt() and 1810 * br_aes_ct_bitslice_decrypt(). 1811 */ 1812void br_aes_ct_skey_expand(uint32_t *skey, 1813 unsigned num_rounds, const uint32_t *comp_skey); 1814 1815/* 1816 * For the ct64 implementation, the same bitslicing technique is used, 1817 * but four instances are interleaved. First instance uses bits 0, 4, 1818 * 8, 12,... of each word; second instance uses bits 1, 5, 9, 13,... 1819 * and so on. 1820 */ 1821 1822/* 1823 * Perform bytewise orthogonalization of eight 64-bit words. Bytes 1824 * of q0..q7 are spread over all words: for a byte x that occurs 1825 * at rank i in q[j] (byte x uses bits 8*i to 8*i+7 in q[j]), the bit 1826 * of rank k in x (0 <= k <= 7) goes to q[k] at rank 8*i+j. 1827 * 1828 * This operation is an involution. 1829 */ 1830void br_aes_ct64_ortho(uint64_t *q); 1831 1832/* 1833 * Interleave bytes for an AES input block. If input bytes are 1834 * denoted 0123456789ABCDEF, and have been decoded with little-endian 1835 * convention (w[0] contains 0123, with '3' being most significant; 1836 * w[1] contains 4567, and so on), then output word q0 will be 1837 * set to 08192A3B (again little-endian convention) and q1 will 1838 * be set to 4C5D6E7F. 1839 */ 1840void br_aes_ct64_interleave_in(uint64_t *q0, uint64_t *q1, const uint32_t *w); 1841 1842/* 1843 * Perform the opposite of br_aes_ct64_interleave_in(). 1844 */ 1845void br_aes_ct64_interleave_out(uint32_t *w, uint64_t q0, uint64_t q1); 1846 1847/* 1848 * The AES S-box, as a bitsliced constant-time version. The input array 1849 * consists in eight 64-bit words; 64 S-box instances are computed in 1850 * parallel. Bits 0 to 7 of each S-box input (bit 0 is least significant) 1851 * are spread over the words 0 to 7, at the same rank. 1852 */ 1853void br_aes_ct64_bitslice_Sbox(uint64_t *q); 1854 1855/* 1856 * Like br_aes_bitslice_Sbox(), but for the inverse S-box. 1857 */ 1858void br_aes_ct64_bitslice_invSbox(uint64_t *q); 1859 1860/* 1861 * Compute AES encryption on bitsliced data. Since input is stored on 1862 * eight 64-bit words, four block encryptions are actually performed 1863 * in parallel. 1864 */ 1865void br_aes_ct64_bitslice_encrypt(unsigned num_rounds, 1866 const uint64_t *skey, uint64_t *q); 1867 1868/* 1869 * Compute AES decryption on bitsliced data. Since input is stored on 1870 * eight 64-bit words, four block decryptions are actually performed 1871 * in parallel. 1872 */ 1873void br_aes_ct64_bitslice_decrypt(unsigned num_rounds, 1874 const uint64_t *skey, uint64_t *q); 1875 1876/* 1877 * AES key schedule, constant-time version. skey[] is filled with n+1 1878 * 128-bit subkeys, where n is the number of rounds (10 to 14, depending 1879 * on key size). The number of rounds is returned. If the key size is 1880 * invalid (not 16, 24 or 32), then 0 is returned. 1881 */ 1882unsigned br_aes_ct64_keysched(uint64_t *comp_skey, 1883 const void *key, size_t key_len); 1884 1885/* 1886 * Expand AES subkeys as produced by br_aes_ct64_keysched(), into 1887 * a larger array suitable for br_aes_ct64_bitslice_encrypt() and 1888 * br_aes_ct64_bitslice_decrypt(). 1889 */ 1890void br_aes_ct64_skey_expand(uint64_t *skey, 1891 unsigned num_rounds, const uint64_t *comp_skey); 1892 1893/* 1894 * Test support for AES-NI opcodes. 1895 */ 1896int br_aes_x86ni_supported(void); 1897 1898/* 1899 * AES key schedule, using x86 AES-NI instructions. This yields the 1900 * subkeys in the encryption direction. Number of rounds is returned. 1901 * Key size MUST be 16, 24 or 32 bytes; otherwise, 0 is returned. 1902 */ 1903unsigned br_aes_x86ni_keysched_enc(unsigned char *skni, 1904 const void *key, size_t len); 1905 1906/* 1907 * AES key schedule, using x86 AES-NI instructions. This yields the 1908 * subkeys in the decryption direction. Number of rounds is returned. 1909 * Key size MUST be 16, 24 or 32 bytes; otherwise, 0 is returned. 1910 */ 1911unsigned br_aes_x86ni_keysched_dec(unsigned char *skni, 1912 const void *key, size_t len); 1913 1914/* 1915 * Test support for AES POWER8 opcodes. 1916 */ 1917int br_aes_pwr8_supported(void); 1918 1919/* 1920 * AES key schedule, using POWER8 instructions. This yields the 1921 * subkeys in the encryption direction. Number of rounds is returned. 1922 * Key size MUST be 16, 24 or 32 bytes; otherwise, 0 is returned. 1923 */ 1924unsigned br_aes_pwr8_keysched(unsigned char *skni, 1925 const void *key, size_t len); 1926 1927/* ==================================================================== */ 1928/* 1929 * RSA. 1930 */ 1931 1932/* 1933 * Apply proper PKCS#1 v1.5 padding (for signatures). 'hash_oid' is 1934 * the encoded hash function OID, or NULL. 1935 */ 1936uint32_t br_rsa_pkcs1_sig_pad(const unsigned char *hash_oid, 1937 const unsigned char *hash, size_t hash_len, 1938 uint32_t n_bitlen, unsigned char *x); 1939 1940/* 1941 * Check PKCS#1 v1.5 padding (for signatures). 'hash_oid' is the encoded 1942 * hash function OID, or NULL. The provided 'sig' value is _after_ the 1943 * modular exponentiation, i.e. it should be the padded hash. On 1944 * success, the hashed message is extracted. 1945 */ 1946uint32_t br_rsa_pkcs1_sig_unpad(const unsigned char *sig, size_t sig_len, 1947 const unsigned char *hash_oid, size_t hash_len, 1948 unsigned char *hash_out); 1949 1950/* 1951 * Apply proper PSS padding. The 'x' buffer is output only: it 1952 * receives the value that is to be exponentiated. 1953 */ 1954uint32_t br_rsa_pss_sig_pad(const br_prng_class **rng, 1955 const br_hash_class *hf_data, const br_hash_class *hf_mgf1, 1956 const unsigned char *hash, size_t salt_len, 1957 uint32_t n_bitlen, unsigned char *x); 1958 1959/* 1960 * Check PSS padding. The provided value is the one _after_ 1961 * the modular exponentiation; it is modified by this function. 1962 * This function infers the signature length from the public key 1963 * size, i.e. it assumes that this has already been verified (as 1964 * part of the exponentiation). 1965 */ 1966uint32_t br_rsa_pss_sig_unpad( 1967 const br_hash_class *hf_data, const br_hash_class *hf_mgf1, 1968 const unsigned char *hash, size_t salt_len, 1969 const br_rsa_public_key *pk, unsigned char *x); 1970 1971/* 1972 * Apply OAEP padding. Returned value is the actual padded string length, 1973 * or zero on error. 1974 */ 1975size_t br_rsa_oaep_pad(const br_prng_class **rnd, const br_hash_class *dig, 1976 const void *label, size_t label_len, const br_rsa_public_key *pk, 1977 void *dst, size_t dst_nax_len, const void *src, size_t src_len); 1978 1979/* 1980 * Unravel and check OAEP padding. If the padding is correct, then 1 is 1981 * returned, '*len' is adjusted to the length of the message, and the 1982 * data is moved to the start of the 'data' buffer. If the padding is 1983 * incorrect, then 0 is returned and '*len' is untouched. Either way, 1984 * the complete buffer contents are altered. 1985 */ 1986uint32_t br_rsa_oaep_unpad(const br_hash_class *dig, 1987 const void *label, size_t label_len, void *data, size_t *len); 1988 1989/* 1990 * Compute MGF1 for a given seed, and XOR the output into the provided 1991 * buffer. 1992 */ 1993void br_mgf1_xor(void *data, size_t len, 1994 const br_hash_class *dig, const void *seed, size_t seed_len); 1995 1996/* 1997 * Inner function for RSA key generation; used by the "i31" and "i62" 1998 * implementations. 1999 */ 2000uint32_t br_rsa_i31_keygen_inner(const br_prng_class **rng, 2001 br_rsa_private_key *sk, void *kbuf_priv, 2002 br_rsa_public_key *pk, void *kbuf_pub, 2003 unsigned size, uint32_t pubexp, br_i31_modpow_opt_type mp31); 2004 2005/* ==================================================================== */ 2006/* 2007 * Elliptic curves. 2008 */ 2009 2010/* 2011 * Type for generic EC parameters: curve order (unsigned big-endian 2012 * encoding) and encoded conventional generator. 2013 */ 2014typedef struct { 2015 int curve; 2016 const unsigned char *order; 2017 size_t order_len; 2018 const unsigned char *generator; 2019 size_t generator_len; 2020} br_ec_curve_def; 2021 2022extern const br_ec_curve_def br_secp256r1; 2023extern const br_ec_curve_def br_secp384r1; 2024extern const br_ec_curve_def br_secp521r1; 2025 2026/* 2027 * For Curve25519, the advertised "order" really is 2^255-1, since the 2028 * point multipliction function really works over arbitrary 255-bit 2029 * scalars. This value is only meant as a hint for ECDH key generation; 2030 * only ECDSA uses the exact curve order, and ECDSA is not used with 2031 * that specific curve. 2032 */ 2033extern const br_ec_curve_def br_curve25519; 2034 2035/* 2036 * Decode some bytes as an i31 integer, with truncation (corresponding 2037 * to the 'bits2int' operation in RFC 6979). The target ENCODED bit 2038 * length is provided as last parameter. The resulting value will have 2039 * this declared bit length, and consists the big-endian unsigned decoding 2040 * of exactly that many bits in the source (capped at the source length). 2041 */ 2042void br_ecdsa_i31_bits2int(uint32_t *x, 2043 const void *src, size_t len, uint32_t ebitlen); 2044 2045/* 2046 * Decode some bytes as an i15 integer, with truncation (corresponding 2047 * to the 'bits2int' operation in RFC 6979). The target ENCODED bit 2048 * length is provided as last parameter. The resulting value will have 2049 * this declared bit length, and consists the big-endian unsigned decoding 2050 * of exactly that many bits in the source (capped at the source length). 2051 */ 2052void br_ecdsa_i15_bits2int(uint16_t *x, 2053 const void *src, size_t len, uint32_t ebitlen); 2054 2055/* ==================================================================== */ 2056/* 2057 * ASN.1 support functions. 2058 */ 2059 2060/* 2061 * A br_asn1_uint structure contains encoding information about an 2062 * INTEGER nonnegative value: pointer to the integer contents (unsigned 2063 * big-endian representation), length of the integer contents, 2064 * and length of the encoded value. The data shall have minimal length: 2065 * - If the integer value is zero, then 'len' must be zero. 2066 * - If the integer value is not zero, then data[0] must be non-zero. 2067 * 2068 * Under these conditions, 'asn1len' is necessarily equal to either len 2069 * or len+1. 2070 */ 2071typedef struct { 2072 const unsigned char *data; 2073 size_t len; 2074 size_t asn1len; 2075} br_asn1_uint; 2076 2077/* 2078 * Given an encoded integer (unsigned big-endian, with possible leading 2079 * bytes of value 0), returned the "prepared INTEGER" structure. 2080 */ 2081br_asn1_uint br_asn1_uint_prepare(const void *xdata, size_t xlen); 2082 2083/* 2084 * Encode an ASN.1 length. The length of the encoded length is returned. 2085 * If 'dest' is NULL, then no encoding is performed, but the length of 2086 * the encoded length is still computed and returned. 2087 */ 2088size_t br_asn1_encode_length(void *dest, size_t len); 2089 2090/* 2091 * Convenient macro for computing lengths of lengths. 2092 */ 2093#define len_of_len(len) br_asn1_encode_length(NULL, len) 2094 2095/* 2096 * Encode a (prepared) ASN.1 INTEGER. The encoded length is returned. 2097 * If 'dest' is NULL, then no encoding is performed, but the length of 2098 * the encoded integer is still computed and returned. 2099 */ 2100size_t br_asn1_encode_uint(void *dest, br_asn1_uint pp); 2101 2102/* 2103 * Get the OID that identifies an elliptic curve. Returned value is 2104 * the DER-encoded OID, with the length (always one byte) but without 2105 * the tag. Thus, the first byte of the returned buffer contains the 2106 * number of subsequent bytes in the value. If the curve is not 2107 * recognised, NULL is returned. 2108 */ 2109const unsigned char *br_get_curve_OID(int curve); 2110 2111/* 2112 * Inner function for EC private key encoding. This is equivalent to 2113 * the API function br_encode_ec_raw_der(), except for an extra 2114 * parameter: if 'include_curve_oid' is zero, then the curve OID is 2115 * _not_ included in the output blob (this is for PKCS#8 support). 2116 */ 2117size_t br_encode_ec_raw_der_inner(void *dest, 2118 const br_ec_private_key *sk, const br_ec_public_key *pk, 2119 int include_curve_oid); 2120 2121/* ==================================================================== */ 2122/* 2123 * SSL/TLS support functions. 2124 */ 2125 2126/* 2127 * Record types. 2128 */ 2129#define BR_SSL_CHANGE_CIPHER_SPEC 20 2130#define BR_SSL_ALERT 21 2131#define BR_SSL_HANDSHAKE 22 2132#define BR_SSL_APPLICATION_DATA 23 2133 2134/* 2135 * Handshake message types. 2136 */ 2137#define BR_SSL_HELLO_REQUEST 0 2138#define BR_SSL_CLIENT_HELLO 1 2139#define BR_SSL_SERVER_HELLO 2 2140#define BR_SSL_CERTIFICATE 11 2141#define BR_SSL_SERVER_KEY_EXCHANGE 12 2142#define BR_SSL_CERTIFICATE_REQUEST 13 2143#define BR_SSL_SERVER_HELLO_DONE 14 2144#define BR_SSL_CERTIFICATE_VERIFY 15 2145#define BR_SSL_CLIENT_KEY_EXCHANGE 16 2146#define BR_SSL_FINISHED 20 2147 2148/* 2149 * Alert levels. 2150 */ 2151#define BR_LEVEL_WARNING 1 2152#define BR_LEVEL_FATAL 2 2153 2154/* 2155 * Low-level I/O state. 2156 */ 2157#define BR_IO_FAILED 0 2158#define BR_IO_IN 1 2159#define BR_IO_OUT 2 2160#define BR_IO_INOUT 3 2161 2162/* 2163 * Mark a SSL engine as failed. The provided error code is recorded if 2164 * the engine was not already marked as failed. If 'err' is 0, then the 2165 * engine is marked as closed (without error). 2166 */ 2167void br_ssl_engine_fail(br_ssl_engine_context *cc, int err); 2168 2169/* 2170 * Test whether the engine is closed (normally or as a failure). 2171 */ 2172static inline int 2173br_ssl_engine_closed(const br_ssl_engine_context *cc) 2174{ 2175 return cc->iomode == BR_IO_FAILED; 2176} 2177 2178/* 2179 * Configure a new maximum fragment length. If possible, the maximum 2180 * length for outgoing records is immediately adjusted (if there are 2181 * not already too many buffered bytes for that). 2182 */ 2183void br_ssl_engine_new_max_frag_len( 2184 br_ssl_engine_context *rc, unsigned max_frag_len); 2185 2186/* 2187 * Test whether the current incoming record has been fully received 2188 * or not. This functions returns 0 only if a complete record header 2189 * has been received, but some of the (possibly encrypted) payload 2190 * has not yet been obtained. 2191 */ 2192int br_ssl_engine_recvrec_finished(const br_ssl_engine_context *rc); 2193 2194/* 2195 * Flush the current record (if not empty). This is meant to be called 2196 * from the handshake processor only. 2197 */ 2198void br_ssl_engine_flush_record(br_ssl_engine_context *cc); 2199 2200/* 2201 * Test whether there is some accumulated payload to send. 2202 */ 2203static inline int 2204br_ssl_engine_has_pld_to_send(const br_ssl_engine_context *rc) 2205{ 2206 return rc->oxa != rc->oxb && rc->oxa != rc->oxc; 2207} 2208 2209/* 2210 * Initialize RNG in engine. Returned value is 1 on success, 0 on error. 2211 * This function will try to use the OS-provided RNG, if available. If 2212 * there is no OS-provided RNG, or if it failed, and no entropy was 2213 * injected by the caller, then a failure will be reported. On error, 2214 * the context error code is set. 2215 */ 2216int br_ssl_engine_init_rand(br_ssl_engine_context *cc); 2217 2218/* 2219 * Reset the handshake-related parts of the engine. 2220 */ 2221void br_ssl_engine_hs_reset(br_ssl_engine_context *cc, 2222 void (*hsinit)(void *), void (*hsrun)(void *)); 2223 2224/* 2225 * Get the PRF to use for this context, for the provided PRF hash 2226 * function ID. 2227 */ 2228br_tls_prf_impl br_ssl_engine_get_PRF(br_ssl_engine_context *cc, int prf_id); 2229 2230/* 2231 * Consume the provided pre-master secret and compute the corresponding 2232 * master secret. The 'prf_id' is the ID of the hash function to use 2233 * with the TLS 1.2 PRF (ignored if the version is TLS 1.0 or 1.1). 2234 */ 2235void br_ssl_engine_compute_master(br_ssl_engine_context *cc, 2236 int prf_id, const void *pms, size_t len); 2237 2238/* 2239 * Switch to CBC decryption for incoming records. 2240 * cc the engine context 2241 * is_client non-zero for a client, zero for a server 2242 * prf_id id of hash function for PRF (ignored if not TLS 1.2+) 2243 * mac_id id of hash function for HMAC 2244 * bc_impl block cipher implementation (CBC decryption) 2245 * cipher_key_len block cipher key length (in bytes) 2246 */ 2247void br_ssl_engine_switch_cbc_in(br_ssl_engine_context *cc, 2248 int is_client, int prf_id, int mac_id, 2249 const br_block_cbcdec_class *bc_impl, size_t cipher_key_len); 2250 2251/* 2252 * Switch to CBC encryption for outgoing records. 2253 * cc the engine context 2254 * is_client non-zero for a client, zero for a server 2255 * prf_id id of hash function for PRF (ignored if not TLS 1.2+) 2256 * mac_id id of hash function for HMAC 2257 * bc_impl block cipher implementation (CBC encryption) 2258 * cipher_key_len block cipher key length (in bytes) 2259 */ 2260void br_ssl_engine_switch_cbc_out(br_ssl_engine_context *cc, 2261 int is_client, int prf_id, int mac_id, 2262 const br_block_cbcenc_class *bc_impl, size_t cipher_key_len); 2263 2264/* 2265 * Switch to GCM decryption for incoming records. 2266 * cc the engine context 2267 * is_client non-zero for a client, zero for a server 2268 * prf_id id of hash function for PRF 2269 * bc_impl block cipher implementation (CTR) 2270 * cipher_key_len block cipher key length (in bytes) 2271 */ 2272void br_ssl_engine_switch_gcm_in(br_ssl_engine_context *cc, 2273 int is_client, int prf_id, 2274 const br_block_ctr_class *bc_impl, size_t cipher_key_len); 2275 2276/* 2277 * Switch to GCM encryption for outgoing records. 2278 * cc the engine context 2279 * is_client non-zero for a client, zero for a server 2280 * prf_id id of hash function for PRF 2281 * bc_impl block cipher implementation (CTR) 2282 * cipher_key_len block cipher key length (in bytes) 2283 */ 2284void br_ssl_engine_switch_gcm_out(br_ssl_engine_context *cc, 2285 int is_client, int prf_id, 2286 const br_block_ctr_class *bc_impl, size_t cipher_key_len); 2287 2288/* 2289 * Switch to ChaCha20+Poly1305 decryption for incoming records. 2290 * cc the engine context 2291 * is_client non-zero for a client, zero for a server 2292 * prf_id id of hash function for PRF 2293 */ 2294void br_ssl_engine_switch_chapol_in(br_ssl_engine_context *cc, 2295 int is_client, int prf_id); 2296 2297/* 2298 * Switch to ChaCha20+Poly1305 encryption for outgoing records. 2299 * cc the engine context 2300 * is_client non-zero for a client, zero for a server 2301 * prf_id id of hash function for PRF 2302 */ 2303void br_ssl_engine_switch_chapol_out(br_ssl_engine_context *cc, 2304 int is_client, int prf_id); 2305 2306/* 2307 * Switch to CCM decryption for incoming records. 2308 * cc the engine context 2309 * is_client non-zero for a client, zero for a server 2310 * prf_id id of hash function for PRF 2311 * bc_impl block cipher implementation (CTR+CBC) 2312 * cipher_key_len block cipher key length (in bytes) 2313 * tag_len tag length (in bytes) 2314 */ 2315void br_ssl_engine_switch_ccm_in(br_ssl_engine_context *cc, 2316 int is_client, int prf_id, 2317 const br_block_ctrcbc_class *bc_impl, 2318 size_t cipher_key_len, size_t tag_len); 2319 2320/* 2321 * Switch to GCM encryption for outgoing records. 2322 * cc the engine context 2323 * is_client non-zero for a client, zero for a server 2324 * prf_id id of hash function for PRF 2325 * bc_impl block cipher implementation (CTR+CBC) 2326 * cipher_key_len block cipher key length (in bytes) 2327 * tag_len tag length (in bytes) 2328 */ 2329void br_ssl_engine_switch_ccm_out(br_ssl_engine_context *cc, 2330 int is_client, int prf_id, 2331 const br_block_ctrcbc_class *bc_impl, 2332 size_t cipher_key_len, size_t tag_len); 2333 2334/* 2335 * Calls to T0-generated code. 2336 */ 2337void br_ssl_hs_client_init_main(void *ctx); 2338void br_ssl_hs_client_run(void *ctx); 2339void br_ssl_hs_server_init_main(void *ctx); 2340void br_ssl_hs_server_run(void *ctx); 2341 2342/* 2343 * Get the hash function to use for signatures, given a bit mask of 2344 * supported hash functions. This implements a strict choice order 2345 * (namely SHA-256, SHA-384, SHA-512, SHA-224, SHA-1). If the mask 2346 * does not document support of any of these hash functions, then this 2347 * functions returns 0. 2348 */ 2349int br_ssl_choose_hash(unsigned bf); 2350 2351/* ==================================================================== */ 2352 2353/* 2354 * PowerPC / POWER assembly stuff. The special BR_POWER_ASM_MACROS macro 2355 * must be defined before including this file; this is done by source 2356 * files that use some inline assembly for PowerPC / POWER machines. 2357 */ 2358 2359#if BR_POWER_ASM_MACROS 2360 2361#define lxvw4x(xt, ra, rb) lxvw4x_(xt, ra, rb) 2362#define stxvw4x(xt, ra, rb) stxvw4x_(xt, ra, rb) 2363 2364#define bdnz(foo) bdnz_(foo) 2365#define bdz(foo) bdz_(foo) 2366#define beq(foo) beq_(foo) 2367 2368#define li(rx, value) li_(rx, value) 2369#define addi(rx, ra, imm) addi_(rx, ra, imm) 2370#define cmpldi(rx, imm) cmpldi_(rx, imm) 2371#define mtctr(rx) mtctr_(rx) 2372#define vspltb(vrt, vrb, uim) vspltb_(vrt, vrb, uim) 2373#define vspltw(vrt, vrb, uim) vspltw_(vrt, vrb, uim) 2374#define vspltisb(vrt, imm) vspltisb_(vrt, imm) 2375#define vspltisw(vrt, imm) vspltisw_(vrt, imm) 2376#define vrlw(vrt, vra, vrb) vrlw_(vrt, vra, vrb) 2377#define vsbox(vrt, vra) vsbox_(vrt, vra) 2378#define vxor(vrt, vra, vrb) vxor_(vrt, vra, vrb) 2379#define vand(vrt, vra, vrb) vand_(vrt, vra, vrb) 2380#define vsro(vrt, vra, vrb) vsro_(vrt, vra, vrb) 2381#define vsl(vrt, vra, vrb) vsl_(vrt, vra, vrb) 2382#define vsldoi(vt, va, vb, sh) vsldoi_(vt, va, vb, sh) 2383#define vsr(vrt, vra, vrb) vsr_(vrt, vra, vrb) 2384#define vaddcuw(vrt, vra, vrb) vaddcuw_(vrt, vra, vrb) 2385#define vadduwm(vrt, vra, vrb) vadduwm_(vrt, vra, vrb) 2386#define vsububm(vrt, vra, vrb) vsububm_(vrt, vra, vrb) 2387#define vsubuwm(vrt, vra, vrb) vsubuwm_(vrt, vra, vrb) 2388#define vsrw(vrt, vra, vrb) vsrw_(vrt, vra, vrb) 2389#define vcipher(vt, va, vb) vcipher_(vt, va, vb) 2390#define vcipherlast(vt, va, vb) vcipherlast_(vt, va, vb) 2391#define vncipher(vt, va, vb) vncipher_(vt, va, vb) 2392#define vncipherlast(vt, va, vb) vncipherlast_(vt, va, vb) 2393#define vperm(vt, va, vb, vc) vperm_(vt, va, vb, vc) 2394#define vpmsumd(vt, va, vb) vpmsumd_(vt, va, vb) 2395#define xxpermdi(vt, va, vb, d) xxpermdi_(vt, va, vb, d) 2396 2397#define lxvw4x_(xt, ra, rb) "\tlxvw4x\t" #xt "," #ra "," #rb "\n" 2398#define stxvw4x_(xt, ra, rb) "\tstxvw4x\t" #xt "," #ra "," #rb "\n" 2399 2400#define label(foo) #foo "%=:\n" 2401#define bdnz_(foo) "\tbdnz\t" #foo "%=\n" 2402#define bdz_(foo) "\tbdz\t" #foo "%=\n" 2403#define beq_(foo) "\tbeq\t" #foo "%=\n" 2404 2405#define li_(rx, value) "\tli\t" #rx "," #value "\n" 2406#define addi_(rx, ra, imm) "\taddi\t" #rx "," #ra "," #imm "\n" 2407#define cmpldi_(rx, imm) "\tcmpldi\t" #rx "," #imm "\n" 2408#define mtctr_(rx) "\tmtctr\t" #rx "\n" 2409#define vspltb_(vrt, vrb, uim) "\tvspltb\t" #vrt "," #vrb "," #uim "\n" 2410#define vspltw_(vrt, vrb, uim) "\tvspltw\t" #vrt "," #vrb "," #uim "\n" 2411#define vspltisb_(vrt, imm) "\tvspltisb\t" #vrt "," #imm "\n" 2412#define vspltisw_(vrt, imm) "\tvspltisw\t" #vrt "," #imm "\n" 2413#define vrlw_(vrt, vra, vrb) "\tvrlw\t" #vrt "," #vra "," #vrb "\n" 2414#define vsbox_(vrt, vra) "\tvsbox\t" #vrt "," #vra "\n" 2415#define vxor_(vrt, vra, vrb) "\tvxor\t" #vrt "," #vra "," #vrb "\n" 2416#define vand_(vrt, vra, vrb) "\tvand\t" #vrt "," #vra "," #vrb "\n" 2417#define vsro_(vrt, vra, vrb) "\tvsro\t" #vrt "," #vra "," #vrb "\n" 2418#define vsl_(vrt, vra, vrb) "\tvsl\t" #vrt "," #vra "," #vrb "\n" 2419#define vsldoi_(vt, va, vb, sh) "\tvsldoi\t" #vt "," #va "," #vb "," #sh "\n" 2420#define vsr_(vrt, vra, vrb) "\tvsr\t" #vrt "," #vra "," #vrb "\n" 2421#define vaddcuw_(vrt, vra, vrb) "\tvaddcuw\t" #vrt "," #vra "," #vrb "\n" 2422#define vadduwm_(vrt, vra, vrb) "\tvadduwm\t" #vrt "," #vra "," #vrb "\n" 2423#define vsububm_(vrt, vra, vrb) "\tvsububm\t" #vrt "," #vra "," #vrb "\n" 2424#define vsubuwm_(vrt, vra, vrb) "\tvsubuwm\t" #vrt "," #vra "," #vrb "\n" 2425#define vsrw_(vrt, vra, vrb) "\tvsrw\t" #vrt "," #vra "," #vrb "\n" 2426#define vcipher_(vt, va, vb) "\tvcipher\t" #vt "," #va "," #vb "\n" 2427#define vcipherlast_(vt, va, vb) "\tvcipherlast\t" #vt "," #va "," #vb "\n" 2428#define vncipher_(vt, va, vb) "\tvncipher\t" #vt "," #va "," #vb "\n" 2429#define vncipherlast_(vt, va, vb) "\tvncipherlast\t" #vt "," #va "," #vb "\n" 2430#define vperm_(vt, va, vb, vc) "\tvperm\t" #vt "," #va "," #vb "," #vc "\n" 2431#define vpmsumd_(vt, va, vb) "\tvpmsumd\t" #vt "," #va "," #vb "\n" 2432#define xxpermdi_(vt, va, vb, d) "\txxpermdi\t" #vt "," #va "," #vb "," #d "\n" 2433 2434#endif 2435 2436/* ==================================================================== */ 2437/* 2438 * Special "activate intrinsics" code, needed for some compiler versions. 2439 * This is defined at the end of this file, so that it won't impact any 2440 * of the inline functions defined previously; and it is controlled by 2441 * a specific macro defined in the caller code. 2442 * 2443 * Calling code conventions: 2444 * 2445 * - Caller must define BR_ENABLE_INTRINSICS before including "inner.h". 2446 * - Functions that use intrinsics must be enclosed in an "enabled" 2447 * region (between BR_TARGETS_X86_UP and BR_TARGETS_X86_DOWN). 2448 * - Functions that use intrinsics must be tagged with the appropriate 2449 * BR_TARGET(). 2450 */ 2451 2452#if BR_ENABLE_INTRINSICS && (BR_GCC_4_4 || BR_CLANG_3_7 || BR_MSC_2005) 2453 2454/* 2455 * x86 intrinsics (both 32-bit and 64-bit). 2456 */ 2457#if BR_i386 || BR_amd64 2458 2459/* 2460 * On GCC before version 5.0, we need to use the pragma to enable the 2461 * target options globally, because the 'target' function attribute 2462 * appears to be unreliable. Before 4.6 we must also avoid the 2463 * push_options / pop_options mechanism, because it tends to trigger 2464 * some internal compiler errors. 2465 */ 2466#if BR_GCC && !BR_GCC_5_0 2467#if BR_GCC_4_6 2468#define BR_TARGETS_X86_UP \ 2469 _Pragma("GCC push_options") \ 2470 _Pragma("GCC target(\"sse2,ssse3,sse4.1,aes,pclmul,rdrnd\")") 2471#define BR_TARGETS_X86_DOWN \ 2472 _Pragma("GCC pop_options") 2473#else 2474#define BR_TARGETS_X86_UP \ 2475 _Pragma("GCC target(\"sse2,ssse3,sse4.1,aes,pclmul\")") 2476#define BR_TARGETS_X86_DOWN 2477#endif 2478#pragma GCC diagnostic ignored "-Wpsabi" 2479#endif 2480 2481#if BR_CLANG && !BR_CLANG_3_8 2482#undef __SSE2__ 2483#undef __SSE3__ 2484#undef __SSSE3__ 2485#undef __SSE4_1__ 2486#undef __AES__ 2487#undef __PCLMUL__ 2488#undef __RDRND__ 2489#define __SSE2__ 1 2490#define __SSE3__ 1 2491#define __SSSE3__ 1 2492#define __SSE4_1__ 1 2493#define __AES__ 1 2494#define __PCLMUL__ 1 2495#define __RDRND__ 1 2496#endif 2497 2498#ifndef BR_TARGETS_X86_UP 2499#define BR_TARGETS_X86_UP 2500#endif 2501#ifndef BR_TARGETS_X86_DOWN 2502#define BR_TARGETS_X86_DOWN 2503#endif 2504 2505#if BR_GCC || BR_CLANG 2506BR_TARGETS_X86_UP 2507#include <x86intrin.h> 2508#include <cpuid.h> 2509#define br_bswap32 __builtin_bswap32 2510BR_TARGETS_X86_DOWN 2511#endif 2512 2513#if BR_MSC 2514#include <stdlib.h> 2515#include <intrin.h> 2516#include <immintrin.h> 2517#define br_bswap32 _byteswap_ulong 2518#endif 2519 2520static inline int 2521br_cpuid(uint32_t mask_eax, uint32_t mask_ebx, 2522 uint32_t mask_ecx, uint32_t mask_edx) 2523{ 2524#if BR_GCC || BR_CLANG 2525 unsigned eax, ebx, ecx, edx; 2526 2527 if (__get_cpuid(1, &eax, &ebx, &ecx, &edx)) { 2528 if ((eax & mask_eax) == mask_eax 2529 && (ebx & mask_ebx) == mask_ebx 2530 && (ecx & mask_ecx) == mask_ecx 2531 && (edx & mask_edx) == mask_edx) 2532 { 2533 return 1; 2534 } 2535 } 2536#elif BR_MSC 2537 int info[4]; 2538 2539 __cpuid(info, 1); 2540 if (((uint32_t)info[0] & mask_eax) == mask_eax 2541 && ((uint32_t)info[1] & mask_ebx) == mask_ebx 2542 && ((uint32_t)info[2] & mask_ecx) == mask_ecx 2543 && ((uint32_t)info[3] & mask_edx) == mask_edx) 2544 { 2545 return 1; 2546 } 2547#endif 2548 return 0; 2549} 2550 2551#endif 2552 2553#endif 2554 2555/* ==================================================================== */ 2556 2557#endif 2558