Skip to content

Commit 14c3d2a

Browse files
committed
crypto/elliptic: import fiat-crypto P-521 field implementation
Fiat Cryptography (https://github.com/mit-plv/fiat-crypto) is a project that produces prime order field implementations (the code that does arithmetic modulo a prime number) based on a formally verified model. The formal verification covers some of the most subtle and hard to test parts of an elliptic curve implementation, like carry chains. It would probably have prevented #20040 and #43786. This CL imports a 64-bit implementation of the P-521 base field, replacing the horribly slow and catastrophically variable time big.Int CurveParams implementation. The code in p521_fiat64.go is generated reproducibly by fiat-crypto, building and running the Dockerfile according to the README. The code in fiat/p521.go is a thin and idiomatic wrapper around the fiat-crypto code. It includes an Invert method generated with the help of github.com/mmcloughlin/addchain. The code in elliptic/p521.go is a line-by-line port of the CurveParams implementation. Lsh(x, N) was replaced with repeated Add(x, x) calls. Mul(x, x) was replaced with Square(x). Mod calls were removed, as all operations are modulo P. Likewise, Add calls to bring values back to positive were removed. The ScalarMult ladder implementation is now constant time, copied from p224ScalarMult. Only other notable changes are adding a p512Point type to keep (x, y, z) together, and making addJacobian and doubleJacobian methods on that type, with the usual receiver semantics to save 4 allocations per step. This amounts to a proof of concept, and is far from a mature elliptic curve implementation. Here's a non-exhaustive list of things that need improvement, most of which are pre-existing issues with crypto/elliptic. Some of these can be fixed without API change, so can't. - Marshal and Unmarshal still use the slow, variable time big.Int arithmetic. The Curve interface does not expose field operations, so we'll have to make our own abstraction. - Point addition uses an incomplete Jacobian formula, which has variable time behaviors for points at infinity and equal points. There are better, complete formulae these days, but I wanted to keep this CL reviewable against the existing code. - The scalar multiplication ladder is still heavily variable time. This is easy to fix and I'll do it in a follow-up CL, but I wanted to keep this one easier to review. - Fundamentally, values have to go in and out of big.Int representation when they pass through the Curve interface, which is both slow and slightly variable-time. - There is no scalar field implementation, so crypto/ecdsa ends up using big.Int for signing. - Extending this to P-384 would involve either duplicating all P-521 code, or coming up with some lower-level interfaces for the base field. Even better, generics, which would maybe let us save heap allocations due to virtual calls. - The readability and idiomaticity of the autogenerated code can improve, although we have a clear abstraction and well-enforced contract, which makes it unlikely we'll have to resort to manually modifying the code. See mit-plv/fiat-crypto#949. - We could also have a 32-bit implementation, since it's almost free to have fiat-crypto generate one. Anyway, it's definitely better than CurveParams, and definitely faster. name old time/op new time/op delta pkg:crypto/elliptic goos:darwin goarch:arm64 ScalarBaseMult/P521-8 4.18ms ± 3% 0.86ms ± 2% -79.50% (p=0.000 n=10+9) ScalarMult/P521-8 4.17ms ± 2% 0.85ms ± 6% -79.68% (p=0.000 n=10+10) pkg:crypto/ecdsa goos:darwin goarch:arm64 Sign/P521-8 4.23ms ± 1% 0.94ms ± 0% -77.70% (p=0.000 n=9+8) Verify/P521-8 8.31ms ± 2% 1.75ms ± 4% -78.99% (p=0.000 n=9+10) GenerateKey/P521-8 4.15ms ± 2% 0.85ms ± 2% -79.49% (p=0.000 n=10+9) name old alloc/op new alloc/op delta pkg:crypto/elliptic goos:darwin goarch:arm64 ScalarBaseMult/P521-8 3.06MB ± 3% 0.00MB ± 0% -99.97% (p=0.000 n=10+10) ScalarMult/P521-8 3.05MB ± 1% 0.00MB ± 0% -99.97% (p=0.000 n=9+10) pkg:crypto/ecdsa goos:darwin goarch:arm64 Sign/P521-8 3.03MB ± 0% 0.01MB ± 0% -99.74% (p=0.000 n=10+8) Verify/P521-8 6.06MB ± 1% 0.00MB ± 0% -99.93% (p=0.000 n=9+9) GenerateKey/P521-8 3.02MB ± 0% 0.00MB ± 0% -99.96% (p=0.000 n=9+10) name old allocs/op new allocs/op delta pkg:crypto/elliptic goos:darwin goarch:arm64 ScalarBaseMult/P521-8 19.8k ± 3% 0.0k ± 0% -99.95% (p=0.000 n=10+10) ScalarMult/P521-8 19.7k ± 1% 0.0k ± 0% -99.95% (p=0.000 n=9+10) pkg:crypto/ecdsa goos:darwin goarch:arm64 Sign/P521-8 19.6k ± 0% 0.1k ± 0% -99.63% (p=0.000 n=10+10) Verify/P521-8 39.2k ± 1% 0.1k ± 0% -99.84% (p=0.000 n=9+10) GenerateKey/P521-8 19.5k ± 0% 0.0k ± 0% -99.91% (p=0.000 n=9+10) Updates #40171 Change-Id: Ic898b09a2388382bf51ec007d9a79d72d44efe10 Reviewed-on: https://go-review.googlesource.com/c/go/+/315271 Run-TryBot: Filippo Valsorda <[email protected]> TryBot-Result: Go Bot <[email protected]> Reviewed-by: Katie Hockman <[email protected]> Trust: Katie Hockman <[email protected]> Trust: Filippo Valsorda <[email protected]>
1 parent ec4efa4 commit 14c3d2a

File tree

8 files changed

+2396
-12
lines changed

8 files changed

+2396
-12
lines changed

src/crypto/elliptic/elliptic.go

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -390,7 +390,6 @@ func UnmarshalCompressed(curve Curve, data []byte) (x, y *big.Int) {
390390

391391
var initonce sync.Once
392392
var p384 *CurveParams
393-
var p521 *CurveParams
394393

395394
func initAll() {
396395
initP224()
@@ -410,17 +409,6 @@ func initP384() {
410409
p384.BitSize = 384
411410
}
412411

413-
func initP521() {
414-
// See FIPS 186-3, section D.2.5
415-
p521 = &CurveParams{Name: "P-521"}
416-
p521.P, _ = new(big.Int).SetString("6864797660130609714981900799081393217269435300143305409394463459185543183397656052122559640661454554977296311391480858037121987999716643812574028291115057151", 10)
417-
p521.N, _ = new(big.Int).SetString("6864797660130609714981900799081393217269435300143305409394463459185543183397655394245057746333217197532963996371363321113864768612440380340372808892707005449", 10)
418-
p521.B, _ = new(big.Int).SetString("051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00", 16)
419-
p521.Gx, _ = new(big.Int).SetString("c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66", 16)
420-
p521.Gy, _ = new(big.Int).SetString("11839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650", 16)
421-
p521.BitSize = 521
422-
}
423-
424412
// P256 returns a Curve which implements NIST P-256 (FIPS 186-3, section D.2.3),
425413
// also known as secp256r1 or prime256v1. The CurveParams.Name of this Curve is
426414
// "P-256".
Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Copyright 2021 The Go Authors. All rights reserved.
2+
# Use of this source code is governed by a BSD-style
3+
# license that can be found in the LICENSE file.
4+
5+
FROM coqorg/coq:8.13.2
6+
7+
RUN git clone https://github.com/mit-plv/fiat-crypto
8+
RUN cd fiat-crypto && git checkout c076f3550bea2bb7f4cb5766a32594b9e67694f2
9+
RUN cd fiat-crypto && git submodule update --init --recursive
10+
RUN cd fiat-crypto && eval $(opam env) && make -j4 standalone-ocaml SKIP_BEDROCK2=1
11+
12+
ENTRYPOINT ["fiat-crypto/src/ExtractionOCaml/unsaturated_solinas"]
Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
The code in this package was autogenerated by the fiat-crypto project
2+
at commit c076f3550 from a formally verified model.
3+
4+
docker build -t fiat-crypto:c076f3550 .
5+
docker run fiat-crypto:c076f3550 --lang Go --no-wide-int --cmovznz-by-mul \
6+
--internal-static --public-function-case camelCase --public-type-case camelCase \
7+
--private-function-case camelCase --private-type-case camelCase \
8+
--no-prefix-fiat --package-name fiat --doc-text-before-function-name '' \
9+
--doc-prepend-header 'Code generated by Fiat Cryptography. DO NOT EDIT.' \
10+
--doc-newline-before-package-declaration p521 64 9 '2^521 - 1' \
11+
carry_mul carry_square carry add sub to_bytes from_bytes selectznz \
12+
> p521_fiat64.go
13+
14+
It comes under the following license.
15+
16+
Copyright (c) 2015-2020 The fiat-crypto Authors. All rights reserved.
17+
18+
Redistribution and use in source and binary forms, with or without
19+
modification, are permitted provided that the following conditions are
20+
met:
21+
22+
1. Redistributions of source code must retain the above copyright
23+
notice, this list of conditions and the following disclaimer.
24+
25+
THIS SOFTWARE IS PROVIDED BY the fiat-crypto authors "AS IS"
26+
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
27+
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28+
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL Berkeley Software Design,
29+
Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
30+
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
31+
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
32+
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
33+
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
34+
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
35+
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36+
37+
The authors are listed at
38+
39+
https://github.com/mit-plv/fiat-crypto/blob/master/AUTHORS
Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
// Copyright 2021 The Go Authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style
3+
// license that can be found in the LICENSE file.
4+
5+
// Package fiat implements prime order fields using formally verified algorithms
6+
// from the Fiat Cryptography project.
7+
package fiat
8+
9+
import (
10+
"crypto/subtle"
11+
"errors"
12+
)
13+
14+
// P521Element is an integer modulo 2^521 - 1.
15+
//
16+
// The zero value is a valid zero element.
17+
type P521Element struct {
18+
// This element has the following bounds, which are tighter than
19+
// the output bounds of some operations. Those operations must be
20+
// followed by a carry.
21+
//
22+
// [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000],
23+
// [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000],
24+
// [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000], [0x0 ~> 0x200000000000000]
25+
x [9]uint64
26+
}
27+
28+
// One sets e = 1, and returns e.
29+
func (e *P521Element) One() *P521Element {
30+
*e = P521Element{}
31+
e.x[0] = 1
32+
return e
33+
}
34+
35+
// Equal returns 1 if e == t, and zero otherwise.
36+
func (e *P521Element) Equal(t *P521Element) int {
37+
eBytes := e.Bytes()
38+
tBytes := t.Bytes()
39+
return subtle.ConstantTimeCompare(eBytes, tBytes)
40+
}
41+
42+
var p521ZeroEncoding = new(P521Element).Bytes()
43+
44+
// IsZero returns 1 if e == 0, and zero otherwise.
45+
func (e *P521Element) IsZero() int {
46+
eBytes := e.Bytes()
47+
return subtle.ConstantTimeCompare(eBytes, p521ZeroEncoding)
48+
}
49+
50+
// Set sets e = t, and returns e.
51+
func (e *P521Element) Set(t *P521Element) *P521Element {
52+
e.x = t.x
53+
return e
54+
}
55+
56+
// Bytes returns the 66-byte little-endian encoding of e.
57+
func (e *P521Element) Bytes() []byte {
58+
// This function must be inlined to move the allocation to the parent and
59+
// save it from escaping to the heap.
60+
var out [66]byte
61+
p521ToBytes(&out, &e.x)
62+
return out[:]
63+
}
64+
65+
// SetBytes sets e = v, where v is a little-endian 66-byte encoding, and returns
66+
// e. If v is not 66 bytes or it encodes a value higher than 2^521 - 1, SetBytes
67+
// returns nil and an error, and e is unchanged.
68+
func (e *P521Element) SetBytes(v []byte) (*P521Element, error) {
69+
if len(v) != 66 || v[65] > 1 {
70+
return nil, errors.New("invalid P-521 field encoding")
71+
}
72+
var in [66]byte
73+
copy(in[:], v)
74+
p521FromBytes(&e.x, &in)
75+
return e, nil
76+
}
77+
78+
// Add sets e = t1 + t2, and returns e.
79+
func (e *P521Element) Add(t1, t2 *P521Element) *P521Element {
80+
p521Add(&e.x, &t1.x, &t2.x)
81+
p521Carry(&e.x, &e.x)
82+
return e
83+
}
84+
85+
// Sub sets e = t1 - t2, and returns e.
86+
func (e *P521Element) Sub(t1, t2 *P521Element) *P521Element {
87+
p521Sub(&e.x, &t1.x, &t2.x)
88+
p521Carry(&e.x, &e.x)
89+
return e
90+
}
91+
92+
// Mul sets e = t1 * t2, and returns e.
93+
func (e *P521Element) Mul(t1, t2 *P521Element) *P521Element {
94+
p521CarryMul(&e.x, &t1.x, &t2.x)
95+
return e
96+
}
97+
98+
// Square sets e = t * t, and returns e.
99+
func (e *P521Element) Square(t *P521Element) *P521Element {
100+
p521CarrySquare(&e.x, &t.x)
101+
return e
102+
}
103+
104+
// Select sets e to a if cond == 1, and to b if cond == 0.
105+
func (v *P521Element) Select(a, b *P521Element, cond int) *P521Element {
106+
p521Selectznz(&v.x, p521Uint1(cond), &b.x, &a.x)
107+
return v
108+
}
109+
110+
// Invert sets e = 1/t, and returns e.
111+
//
112+
// If t == 0, Invert returns e = 0.
113+
func (e *P521Element) Invert(t *P521Element) *P521Element {
114+
// Inversion is implemented as exponentiation with exponent p − 2.
115+
// The sequence of multiplications and squarings was generated with
116+
// github.com/mmcloughlin/addchain v0.2.0.
117+
118+
var t1, t2 = new(P521Element), new(P521Element)
119+
120+
// _10 = 2 * 1
121+
t1.Square(t)
122+
123+
// _11 = 1 + _10
124+
t1.Mul(t, t1)
125+
126+
// _1100 = _11 << 2
127+
t2.Square(t1)
128+
t2.Square(t2)
129+
130+
// _1111 = _11 + _1100
131+
t1.Mul(t1, t2)
132+
133+
// _11110000 = _1111 << 4
134+
t2.Square(t1)
135+
for i := 0; i < 3; i++ {
136+
t2.Square(t2)
137+
}
138+
139+
// _11111111 = _1111 + _11110000
140+
t1.Mul(t1, t2)
141+
142+
// x16 = _11111111<<8 + _11111111
143+
t2.Square(t1)
144+
for i := 0; i < 7; i++ {
145+
t2.Square(t2)
146+
}
147+
t1.Mul(t1, t2)
148+
149+
// x32 = x16<<16 + x16
150+
t2.Square(t1)
151+
for i := 0; i < 15; i++ {
152+
t2.Square(t2)
153+
}
154+
t1.Mul(t1, t2)
155+
156+
// x64 = x32<<32 + x32
157+
t2.Square(t1)
158+
for i := 0; i < 31; i++ {
159+
t2.Square(t2)
160+
}
161+
t1.Mul(t1, t2)
162+
163+
// x65 = 2*x64 + 1
164+
t2.Square(t1)
165+
t2.Mul(t2, t)
166+
167+
// x129 = x65<<64 + x64
168+
for i := 0; i < 64; i++ {
169+
t2.Square(t2)
170+
}
171+
t1.Mul(t1, t2)
172+
173+
// x130 = 2*x129 + 1
174+
t2.Square(t1)
175+
t2.Mul(t2, t)
176+
177+
// x259 = x130<<129 + x129
178+
for i := 0; i < 129; i++ {
179+
t2.Square(t2)
180+
}
181+
t1.Mul(t1, t2)
182+
183+
// x260 = 2*x259 + 1
184+
t2.Square(t1)
185+
t2.Mul(t2, t)
186+
187+
// x519 = x260<<259 + x259
188+
for i := 0; i < 259; i++ {
189+
t2.Square(t2)
190+
}
191+
t1.Mul(t1, t2)
192+
193+
// return x519<<2 + 1
194+
t1.Square(t1)
195+
t1.Square(t1)
196+
return e.Mul(t1, t)
197+
}

0 commit comments

Comments
 (0)