12976375427

Committed 26 Jan 2025 04:23PM UTC coverage: 91.266% (+0.01%) from 91.256%

Build # 12976375427

Build Type

Pull #4588

github

Committed by

web-flow

Commit Message

Merge 3c17c738d into 9beda9f0f

Pull Request Pull Request #4588: Reduce overhead from computing modular reduction parameters

Run Details

94040 of 103039 relevant lines covered (91.27%)

11353212.71 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

94.59

/src/lib/math/numbertheory/reducer.cpp

/*
* Modular Reducer
* (C) 1999-2011,2018 Jack Lloyd
*
* Botan is released under the Simplified BSD License (see license.txt)
*/

#include <botan/reducer.h>

#include <botan/internal/ct_utils.h>
#include <botan/internal/divide.h>
#include <botan/internal/mp_core.h>

namespace Botan {

/*
* Modular_Reducer Constructor
*/
Modular_Reducer::Modular_Reducer(const BigInt& mod) {
   if(mod < 0) {
      throw Invalid_Argument("Modular_Reducer: modulus must be positive");
   }

   // Left uninitialized if mod == 0
   m_mod_words = 0;

   if(mod > 0) {
      *this = Modular_Reducer::for_secret_modulus(mod);
   }
}

Modular_Reducer Modular_Reducer::for_secret_modulus(const BigInt& mod) {
   BOTAN_ARG_CHECK(!mod.is_zero(), "Modulus cannot be zero");
   BOTAN_ARG_CHECK(!mod.is_negative(), "Modulus cannot be negative");

   // Left uninitialized if mod == 0
   size_t mod_words = mod.sig_words();

   // Compute mu = floor(2^{2k} / m)
   const size_t mu_bits = 2 * BOTAN_MP_WORD_BITS * mod_words;
   BigInt mu = ct_divide_pow2k(mu_bits, mod);
   return Modular_Reducer(mod, mu, mod_words);
}

Modular_Reducer Modular_Reducer::for_public_modulus(const BigInt& mod) {
   BOTAN_ARG_CHECK(!mod.is_zero(), "Modulus cannot be zero");
   BOTAN_ARG_CHECK(!mod.is_negative(), "Modulus cannot be negative");

   // Left uninitialized if mod == 0
   size_t mod_words = mod.sig_words();

   // Compute mu = floor(2^{2k} / m)
   const size_t mu_bits = 2 * BOTAN_MP_WORD_BITS * mod_words;
   BigInt mu = BigInt::power_of_2(mu_bits) / mod;
   return Modular_Reducer(mod, mu, mod_words);
}

BigInt Modular_Reducer::reduce(const BigInt& x) const {
   BigInt r;
   secure_vector<word> ws;
   reduce(r, x, ws);
   return r;
}

BigInt Modular_Reducer::square(const BigInt& x) const {
   secure_vector<word> ws;
   BigInt x2 = x;
   x2.square(ws);
   BigInt r;
   reduce(r, x2, ws);
   return r;
}

namespace {

/*
* Like if(cnd) x.rev_sub(...) but in const time
*/
void cnd_rev_sub(bool cnd, BigInt& x, const word y[], size_t y_sw, secure_vector<word>& ws) {
   if(x.sign() != BigInt::Positive) {
      throw Invalid_State("BigInt::sub_rev requires this is positive");
   }

   const size_t x_sw = x.sig_words();

   const size_t max_words = std::max(x_sw, y_sw);
   ws.resize(std::max(x_sw, y_sw));
   clear_mem(ws.data(), ws.size());
   x.grow_to(max_words);

   const int32_t relative_size = bigint_sub_abs(ws.data(), x._data(), x_sw, y, y_sw);

   x.cond_flip_sign((relative_size > 0) && cnd);
   bigint_cnd_swap(static_cast<word>(cnd), x.mutable_data(), ws.data(), max_words);
}

}  // namespace

void Modular_Reducer::reduce(BigInt& t1, const BigInt& x, secure_vector<word>& ws) const {
   if(&t1 == &x) {
      throw Invalid_State("Modular_Reducer arguments cannot alias");
   }
   if(m_mod_words == 0) {
      throw Invalid_State("Modular_Reducer: Never initalized");
   }

   const size_t x_sw = x.sig_words();

   if(x_sw > 2 * m_mod_words) {
      // too big, fall back to slow boat division
      t1 = ct_modulo(x, m_modulus);
      return;
   }

   t1 = x;
   t1.set_sign(BigInt::Positive);
   t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words - 1));

   t1.mul(m_mu, ws);
   t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words + 1));

   // TODO add masked mul to avoid computing high bits
   t1.mul(m_modulus, ws);
   t1.mask_bits(BOTAN_MP_WORD_BITS * (m_mod_words + 1));

   t1.rev_sub(x._data(), std::min(x_sw, m_mod_words + 1), ws);

   /*
   * If t1 < 0 then we must add b^(k+1) where b = 2^w. To avoid a
   * side channel perform the addition unconditionally, with ws set
   * to either b^(k+1) or else 0.
   */
   const word t1_neg = t1.is_negative();

   if(ws.size() < m_mod_words + 2) {
      ws.resize(m_mod_words + 2);
   }
   clear_mem(ws.data(), ws.size());
   ws[m_mod_words + 1] = t1_neg;

   t1.add(ws.data(), m_mod_words + 2, BigInt::Positive);

   // Per HAC this step requires at most 2 subtractions
   t1.ct_reduce_below(m_modulus, ws, 2);

   cnd_rev_sub(t1.is_nonzero() && x.is_negative(), t1, m_modulus._data(), m_modulus.size(), ws);
}

}  // namespace Botan

1	/*
2	* Modular Reducer
3	* (C) 1999-2011,2018 Jack Lloyd
4	*
5	* Botan is released under the Simplified BSD License (see license.txt)
6	*/
7
8	#include <botan/reducer.h>
9
10	#include <botan/internal/ct_utils.h>
11	#include <botan/internal/divide.h>
12	#include <botan/internal/mp_core.h>
13
14	namespace Botan {
15
16	/*
17	* Modular_Reducer Constructor
18	*/
19	Modular_Reducer::Modular_Reducer(const BigInt& mod) {	1,028✔
20	if(mod < 0) {	1,028✔
21	throw Invalid_Argument("Modular_Reducer: modulus must be positive");	×
22	}
23
24	// Left uninitialized if mod == 0
25	m_mod_words = 0;	1,028✔
26
27	if(mod > 0) {	1,028✔
28	*this = Modular_Reducer::for_secret_modulus(mod);	1,028✔
29	}
30	}	1,028✔
31
32	Modular_Reducer Modular_Reducer::for_secret_modulus(const BigInt& mod) {	45,372✔
33	BOTAN_ARG_CHECK(!mod.is_zero(), "Modulus cannot be zero");	66,294✔
34	BOTAN_ARG_CHECK(!mod.is_negative(), "Modulus cannot be negative");	45,372✔
35
36	// Left uninitialized if mod == 0
37	size_t mod_words = mod.sig_words();	45,372✔
38
39	// Compute mu = floor(2^{2k} / m)
40	const size_t mu_bits = 2 * BOTAN_MP_WORD_BITS * mod_words;	45,372✔
41	BigInt mu = ct_divide_pow2k(mu_bits, mod);	45,372✔
42	return Modular_Reducer(mod, mu, mod_words);	45,372✔
43	}	45,372✔
44
45	Modular_Reducer Modular_Reducer::for_public_modulus(const BigInt& mod) {	77,005✔
46	BOTAN_ARG_CHECK(!mod.is_zero(), "Modulus cannot be zero");	131,314✔
47	BOTAN_ARG_CHECK(!mod.is_negative(), "Modulus cannot be negative");	76,939✔
48
49	// Left uninitialized if mod == 0
50	size_t mod_words = mod.sig_words();	76,932✔
51
52	// Compute mu = floor(2^{2k} / m)
53	const size_t mu_bits = 2 * BOTAN_MP_WORD_BITS * mod_words;	76,932✔
54	BigInt mu = BigInt::power_of_2(mu_bits) / mod;	76,932✔
55	return Modular_Reducer(mod, mu, mod_words);	76,932✔
56	}	76,932✔
57
58	BigInt Modular_Reducer::reduce(const BigInt& x) const {	6,381,878✔
59	BigInt r;	6,381,878✔
60	secure_vector<word> ws;	6,381,878✔
61	reduce(r, x, ws);	6,381,878✔
62	return r;	6,381,878✔
63	}	6,381,878✔
64
65	BigInt Modular_Reducer::square(const BigInt& x) const {	2,287,040✔
66	secure_vector<word> ws;	2,287,040✔
67	BigInt x2 = x;	2,287,040✔
68	x2.square(ws);	2,287,040✔
69	BigInt r;	2,287,040✔
70	reduce(r, x2, ws);	2,287,040✔
71	return r;	2,287,040✔
72	}	4,574,080✔
73
74	namespace {
75
76	/*
77	* Like if(cnd) x.rev_sub(...) but in const time
78	*/
79	void cnd_rev_sub(bool cnd, BigInt& x, const word y[], size_t y_sw, secure_vector<word>& ws) {	8,666,717✔
80	if(x.sign() != BigInt::Positive) {	8,666,717✔
81	throw Invalid_State("BigInt::sub_rev requires this is positive");	×
82	}
83
84	const size_t x_sw = x.sig_words();	8,666,717✔
85
86	const size_t max_words = std::max(x_sw, y_sw);	8,666,717✔
87	ws.resize(std::max(x_sw, y_sw));	8,666,717✔
88	clear_mem(ws.data(), ws.size());	8,666,717✔
89	x.grow_to(max_words);	8,666,717✔
90
91	const int32_t relative_size = bigint_sub_abs(ws.data(), x._data(), x_sw, y, y_sw);	8,666,717✔
92
93	x.cond_flip_sign((relative_size > 0) && cnd);	8,666,717✔
94	bigint_cnd_swap(static_cast<word>(cnd), x.mutable_data(), ws.data(), max_words);	8,666,717✔
95	}	8,666,717✔
96
97	} // namespace
98
99	void Modular_Reducer::reduce(BigInt& t1, const BigInt& x, secure_vector<word>& ws) const {	8,668,918✔
100	if(&t1 == &x) {	8,668,918✔
101	throw Invalid_State("Modular_Reducer arguments cannot alias");	×
102	}
103	if(m_mod_words == 0) {	8,668,918✔
104	throw Invalid_State("Modular_Reducer: Never initalized");	×
105	}
106
107	const size_t x_sw = x.sig_words();	8,668,918✔
108
109	if(x_sw > 2 * m_mod_words) {	8,668,918✔
110	// too big, fall back to slow boat division
111	t1 = ct_modulo(x, m_modulus);	2,201✔
112	return;	2,201✔
113	}
114
115	t1 = x;	8,666,717✔
116	t1.set_sign(BigInt::Positive);	8,666,717✔
117	t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words - 1));	8,666,717✔
118
119	t1.mul(m_mu, ws);	8,666,717✔
120	t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words + 1));	8,666,717✔
121
122	// TODO add masked mul to avoid computing high bits
123	t1.mul(m_modulus, ws);	8,666,717✔
124	t1.mask_bits(BOTAN_MP_WORD_BITS * (m_mod_words + 1));	8,666,717✔
125
126	t1.rev_sub(x._data(), std::min(x_sw, m_mod_words + 1), ws);	10,357,774✔
127
128	/*
129	* If t1 < 0 then we must add b^(k+1) where b = 2^w. To avoid a
130	* side channel perform the addition unconditionally, with ws set
131	* to either b^(k+1) or else 0.
132	*/
133	const word t1_neg = t1.is_negative();	8,666,717✔
134
135	if(ws.size() < m_mod_words + 2) {	8,666,717✔
136	ws.resize(m_mod_words + 2);	36,083✔
137	}
138	clear_mem(ws.data(), ws.size());	8,666,717✔
139	ws[m_mod_words + 1] = t1_neg;	8,666,717✔
140
141	t1.add(ws.data(), m_mod_words + 2, BigInt::Positive);	8,666,717✔
142
143	// Per HAC this step requires at most 2 subtractions
144	t1.ct_reduce_below(m_modulus, ws, 2);	8,666,717✔
145
146	cnd_rev_sub(t1.is_nonzero() && x.is_negative(), t1, m_modulus._data(), m_modulus.size(), ws);	25,122,948✔
147	}
148
149	} // namespace Botan

randombit / botan / 12976375427

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous