5111374265

Committed 29 May 2023 11:19AM UTC coverage: 92.227% (+0.5%) from 91.723%

Build # 5111374265

Build Type

push

github

Committed by

randombit

Commit Message

Next release will be 3.1.0. Update release notes

Run Details

75588 of 81959 relevant lines covered (92.23%)

11886470.91 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

94.34

/src/lib/math/numbertheory/reducer.cpp

/*
* Modular Reducer
* (C) 1999-2011,2018 Jack Lloyd
*
* Botan is released under the Simplified BSD License (see license.txt)
*/

#include <botan/reducer.h>

#include <botan/internal/ct_utils.h>
#include <botan/internal/divide.h>
#include <botan/internal/mp_core.h>

namespace Botan {

/*
* Modular_Reducer Constructor
*/
Modular_Reducer::Modular_Reducer(const BigInt& mod) {
   if(mod < 0)
      throw Invalid_Argument("Modular_Reducer: modulus must be positive");

   // Left uninitialized if mod == 0
   m_mod_words = 0;

   if(mod > 0) {
      m_modulus = mod;
      m_mod_words = m_modulus.sig_words();

      // Compute mu = floor(2^{2k} / m)
      m_mu.set_bit(2 * BOTAN_MP_WORD_BITS * m_mod_words);
      m_mu = ct_divide(m_mu, m_modulus);
   }
}

BigInt Modular_Reducer::reduce(const BigInt& x) const {
   BigInt r;
   secure_vector<word> ws;
   reduce(r, x, ws);
   return r;
}

namespace {

/*
* Like if(cnd) x.rev_sub(...) but in const time
*/
void cnd_rev_sub(bool cnd, BigInt& x, const word y[], size_t y_sw, secure_vector<word>& ws) {
   if(x.sign() != BigInt::Positive)
      throw Invalid_State("BigInt::sub_rev requires this is positive");

   const size_t x_sw = x.sig_words();

   const size_t max_words = std::max(x_sw, y_sw);
   ws.resize(std::max(x_sw, y_sw));
   clear_mem(ws.data(), ws.size());
   x.grow_to(max_words);

   const int32_t relative_size = bigint_sub_abs(ws.data(), x.data(), x_sw, y, y_sw);

   x.cond_flip_sign((relative_size > 0) && cnd);
   bigint_cnd_swap(cnd, x.mutable_data(), ws.data(), max_words);
}

}  // namespace

void Modular_Reducer::reduce(BigInt& t1, const BigInt& x, secure_vector<word>& ws) const {
   if(&t1 == &x)
      throw Invalid_State("Modular_Reducer arguments cannot alias");
   if(m_mod_words == 0)
      throw Invalid_State("Modular_Reducer: Never initalized");

   const size_t x_sw = x.sig_words();

   if(x_sw > 2 * m_mod_words) {
      // too big, fall back to slow boat division
      t1 = ct_modulo(x, m_modulus);
      return;
   }

   t1 = x;
   t1.set_sign(BigInt::Positive);
   t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words - 1));

   t1.mul(m_mu, ws);
   t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words + 1));

   // TODO add masked mul to avoid computing high bits
   t1.mul(m_modulus, ws);
   t1.mask_bits(BOTAN_MP_WORD_BITS * (m_mod_words + 1));

   t1.rev_sub(x.data(), std::min(x_sw, m_mod_words + 1), ws);

   /*
   * If t1 < 0 then we must add b^(k+1) where b = 2^w. To avoid a
   * side channel perform the addition unconditionally, with ws set
   * to either b^(k+1) or else 0.
   */
   const word t1_neg = t1.is_negative();

   if(ws.size() < m_mod_words + 2)
      ws.resize(m_mod_words + 2);
   clear_mem(ws.data(), ws.size());
   ws[m_mod_words + 1] = t1_neg;

   t1.add(ws.data(), m_mod_words + 2, BigInt::Positive);

   // Per HAC this step requires at most 2 subtractions
   t1.ct_reduce_below(m_modulus, ws, 2);

   cnd_rev_sub(t1.is_nonzero() && x.is_negative(), t1, m_modulus.data(), m_modulus.size(), ws);
}

}  // namespace Botan

1	/*
2	* Modular Reducer
3	* (C) 1999-2011,2018 Jack Lloyd
4	*
5	* Botan is released under the Simplified BSD License (see license.txt)
6	*/
7
8	#include <botan/reducer.h>
9
10	#include <botan/internal/ct_utils.h>
11	#include <botan/internal/divide.h>
12	#include <botan/internal/mp_core.h>
13
14	namespace Botan {
15
16	/*
17	* Modular_Reducer Constructor
18	*/
19	Modular_Reducer::Modular_Reducer(const BigInt& mod) {	114,168✔
20	if(mod < 0)	114,168✔
21	throw Invalid_Argument("Modular_Reducer: modulus must be positive");	7✔
22
23	// Left uninitialized if mod == 0
24	m_mod_words = 0;	114,161✔
25
26	if(mod > 0) {	114,161✔
27	m_modulus = mod;	113,832✔
28	m_mod_words = m_modulus.sig_words();	113,832✔
29
30	// Compute mu = floor(2^{2k} / m)
31	m_mu.set_bit(2 * BOTAN_MP_WORD_BITS * m_mod_words);	113,832✔
32	m_mu = ct_divide(m_mu, m_modulus);	341,496✔
33	}
34	}	114,168✔
35
36	BigInt Modular_Reducer::reduce(const BigInt& x) const {	8,340,267✔
37	BigInt r;	8,340,267✔
38	secure_vector<word> ws;	8,340,267✔
39	reduce(r, x, ws);	8,340,267✔
40	return r;	8,340,267✔
41	}	8,340,267✔
42
43	namespace {
44
45	/*
46	* Like if(cnd) x.rev_sub(...) but in const time
47	*/
48	void cnd_rev_sub(bool cnd, BigInt& x, const word y[], size_t y_sw, secure_vector<word>& ws) {	8,337,499✔
49	if(x.sign() != BigInt::Positive)	8,337,499✔
50	throw Invalid_State("BigInt::sub_rev requires this is positive");	×
51
52	const size_t x_sw = x.sig_words();	8,337,499✔
53
54	const size_t max_words = std::max(x_sw, y_sw);	8,337,499✔
55	ws.resize(std::max(x_sw, y_sw));	8,337,499✔
56	clear_mem(ws.data(), ws.size());	8,337,499✔
57	x.grow_to(max_words);	8,337,499✔
58
59	const int32_t relative_size = bigint_sub_abs(ws.data(), x.data(), x_sw, y, y_sw);	8,337,499✔
60
61	x.cond_flip_sign((relative_size > 0) && cnd);	8,337,499✔
62	bigint_cnd_swap(cnd, x.mutable_data(), ws.data(), max_words);	8,337,499✔
63	}	8,337,499✔
64
65	} // namespace
66
67	void Modular_Reducer::reduce(BigInt& t1, const BigInt& x, secure_vector<word>& ws) const {	8,340,267✔
68	if(&t1 == &x)	8,340,267✔
69	throw Invalid_State("Modular_Reducer arguments cannot alias");	×
70	if(m_mod_words == 0)	8,340,267✔
71	throw Invalid_State("Modular_Reducer: Never initalized");	×
72
73	const size_t x_sw = x.sig_words();	8,340,267✔
74
75	if(x_sw > 2 * m_mod_words) {	8,340,267✔
76	// too big, fall back to slow boat division
77	t1 = ct_modulo(x, m_modulus);	2,768✔
78	return;	2,768✔
79	}
80
81	t1 = x;	8,337,499✔
82	t1.set_sign(BigInt::Positive);	8,337,499✔
83	t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words - 1));	8,337,499✔
84
85	t1.mul(m_mu, ws);	8,337,499✔
86	t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words + 1));	8,337,499✔
87
88	// TODO add masked mul to avoid computing high bits
89	t1.mul(m_modulus, ws);	8,337,499✔
90	t1.mask_bits(BOTAN_MP_WORD_BITS * (m_mod_words + 1));	8,337,499✔
91
92	t1.rev_sub(x.data(), std::min(x_sw, m_mod_words + 1), ws);	10,565,038✔
93
94	/*
95	* If t1 < 0 then we must add b^(k+1) where b = 2^w. To avoid a
96	* side channel perform the addition unconditionally, with ws set
97	* to either b^(k+1) or else 0.
98	*/
99	const word t1_neg = t1.is_negative();	8,337,499✔
100
101	if(ws.size() < m_mod_words + 2)	8,337,499✔
102	ws.resize(m_mod_words + 2);	27,940✔
103	clear_mem(ws.data(), ws.size());	8,337,499✔
104	ws[m_mod_words + 1] = t1_neg;	8,337,499✔
105
106	t1.add(ws.data(), m_mod_words + 2, BigInt::Positive);	8,337,499✔
107
108	// Per HAC this step requires at most 2 subtractions
109	t1.ct_reduce_below(m_modulus, ws, 2);	8,337,499✔
110
111	cnd_rev_sub(t1.is_nonzero() && x.is_negative(), t1, m_modulus.data(), m_modulus.size(), ws);	24,276,370✔
112	}
113
114	} // namespace Botan

randombit / botan / 5111374265

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous