j3d1/bearssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Two new Poly1305 implementations: ctmul32 uses pure 32-bit multiplications (MUL15, constant-time on about everything); i15 uses the generic i15 big integers (MUL15 again), which is quite slow but also small.

Browse source
This commit is contained in:
Thomas Pornin 2017-01-05 19:47:00 +01:00
parent 28e4e120b8
commit 7fc1ef315f
7 changed files with 655 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

68
test/test_crypto.c
View file

@ -4113,11 +4113,13 @@ static const struct {
};
static void
test_Poly1305_ctmul(void)
test_Poly1305_inner(const char *name, br_poly1305_run ipoly,
br_poly1305_run iref)
{
size_t u;
br_hmac_drbg_context rng;
printf("Test Poly1305_ctmul: ");
printf("Test %s: ", name);
fflush(stdout);
for (u = 0; KAT_POLY1305[u].skey; u ++) {
@ -4133,7 +4135,7 @@ test_Poly1305_ctmul(void)
hextobin(tag, KAT_POLY1305[u].stag);
memcpy(data, plain, len);
br_poly1305_ctmul_run(key, nonce, data, len,
ipoly(key, nonce, data, len,
aad, aad_len, tmp, br_chacha20_ct_run, 1);
if (memcmp(data, cipher, len) != 0) {
fprintf(stderr, "ChaCha20+Poly1305 KAT failed (1)\n");
@ -4143,7 +4145,7 @@ test_Poly1305_ctmul(void)
fprintf(stderr, "ChaCha20+Poly1305 KAT failed (2)\n");
exit(EXIT_FAILURE);
}
br_poly1305_ctmul_run(key, nonce, data, len,
ipoly(key, nonce, data, len,
aad, aad_len, tmp, br_chacha20_ct_run, 0);
if (memcmp(data, plain, len) != 0) {
fprintf(stderr, "ChaCha20+Poly1305 KAT failed (3)\n");
@ -4158,10 +4160,66 @@ test_Poly1305_ctmul(void)
fflush(stdout);
}
printf(" ");
fflush(stdout);
/*
* We compare the "ipoly" and "iref" implementations together on
* a bunch of pseudo-random messages.
*/
br_hmac_drbg_init(&rng, &br_sha256_vtable, "seed for Poly1305", 17);
for (u = 0; u < 100; u ++) {
unsigned char plain[100], aad[100], tmp[100];
unsigned char key[32], iv[12], tag1[16], tag2[16];
br_hmac_drbg_generate(&rng, key, sizeof key);
br_hmac_drbg_generate(&rng, iv, sizeof iv);
br_hmac_drbg_generate(&rng, plain, u);
br_hmac_drbg_generate(&rng, aad, u);
memcpy(tmp, plain, u);
memset(tmp + u, 0xFF, (sizeof tmp) - u);
ipoly(key, iv, tmp, u, aad, u, tag1,
&br_chacha20_ct_run, 1);
memset(tmp + u, 0x00, (sizeof tmp) - u);
iref(key, iv, tmp, u, aad, u, tag2,
&br_chacha20_ct_run, 0);
if (memcmp(tmp, plain, u) != 0) {
fprintf(stderr, "cross enc/dec failed\n");
exit(EXIT_FAILURE);
}
if (memcmp(tag1, tag2, sizeof tag1) != 0) {
fprintf(stderr, "cross MAC failed\n");
exit(EXIT_FAILURE);
}
printf(".");
fflush(stdout);
}
printf(" done.\n");
fflush(stdout);
}
static void
test_Poly1305_ctmul(void)
{
test_Poly1305_inner("Poly1305_ctmul", &br_poly1305_ctmul_run,
&br_poly1305_i15_run);
}
static void
test_Poly1305_ctmul32(void)
{
test_Poly1305_inner("Poly1305_ctmul32", &br_poly1305_ctmul32_run,
&br_poly1305_i15_run);
}
static void
test_Poly1305_i15(void)
{
test_Poly1305_inner("Poly1305_i15", &br_poly1305_i15_run,
&br_poly1305_ctmul_run);
}
/*
* A 1024-bit RSA key, generated with OpenSSL.
*/
@ -5380,6 +5438,8 @@ static const struct {
STU(DES_ct),
STU(ChaCha20_ct),
STU(Poly1305_ctmul),
STU(Poly1305_ctmul32),
STU(Poly1305_i15),
STU(RSA_i15),
STU(RSA_i31),
STU(RSA_i32),

15
test/test_speed.c
View file

@ -347,6 +347,19 @@ test_speed_poly1305_ctmul(void)
test_speed_poly1305_inner("Poly1305 (ctmul)", &br_poly1305_ctmul_run);
}
static void
test_speed_poly1305_ctmul32(void)
{
test_speed_poly1305_inner("Poly1305 (ctmul32)",
&br_poly1305_ctmul32_run);
}
static void
test_speed_poly1305_i15(void)
{
test_speed_poly1305_inner("Poly1305 (i15)", &br_poly1305_i15_run);
}
static const unsigned char RSA_N[] = {
0xE9, 0xF2, 0x4A, 0x2F, 0x96, 0xDF, 0x0A, 0x23,
0x01, 0x85, 0xF1, 0x2C, 0xB2, 0xA8, 0xEF, 0x23,
@ -1166,6 +1179,8 @@ static const struct {
STU(ghash_ctmul64),
STU(poly1305_ctmul),
STU(poly1305_ctmul32),
STU(poly1305_i15),
STU(rsa_i15),
STU(rsa_i31),