13014411529

Committed 28 Jan 2025 01:04PM UTC coverage: 91.258% (+0.01%) from 91.247%

Build # 13014411529

Build Type

push

github

Committed by

web-flow

Commit Message

Merge pull request #4588 from randombit/jack/faster-redc-setup

Reduce overhead from computing modular reduction parameters

Run Details

94083 of 103096 relevant lines covered (91.26%)

11371294.32 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

94.29

/src/lib/math/numbertheory/reducer.cpp

/*
* Modular Reducer
* (C) 1999-2011,2018 Jack Lloyd
*
* Botan is released under the Simplified BSD License (see license.txt)
*/

#include <botan/reducer.h>

#include <botan/internal/ct_utils.h>
#include <botan/internal/divide.h>
#include <botan/internal/mp_core.h>

namespace Botan {

/*
* Modular_Reducer Constructor
*/
Modular_Reducer::Modular_Reducer(const BigInt& mod) {
   if(mod < 0) {
      throw Invalid_Argument("Modular_Reducer: modulus must be positive");
   }

   // Left uninitialized if mod == 0
   m_mod_words = 0;

   if(mod > 0) {
      *this = Modular_Reducer::for_secret_modulus(mod);
   }
}

Modular_Reducer Modular_Reducer::for_secret_modulus(const BigInt& mod) {
   BOTAN_ARG_CHECK(!mod.is_zero(), "Modulus cannot be zero");
   BOTAN_ARG_CHECK(!mod.is_negative(), "Modulus cannot be negative");

   size_t mod_words = mod.sig_words();

   // Compute mu = floor(2^{2k} / m)
   const size_t mu_bits = 2 * BOTAN_MP_WORD_BITS * mod_words;
   return Modular_Reducer(mod, ct_divide_pow2k(mu_bits, mod), mod_words);
}

Modular_Reducer Modular_Reducer::for_public_modulus(const BigInt& mod) {
   BOTAN_ARG_CHECK(!mod.is_zero(), "Modulus cannot be zero");
   BOTAN_ARG_CHECK(!mod.is_negative(), "Modulus cannot be negative");

   size_t mod_words = mod.sig_words();

   // Compute mu = floor(2^{2k} / m)
   const size_t mu_bits = 2 * BOTAN_MP_WORD_BITS * mod_words;
   return Modular_Reducer(mod, BigInt::power_of_2(mu_bits) / mod, mod_words);
}

BigInt Modular_Reducer::reduce(const BigInt& x) const {
   BigInt r;
   secure_vector<word> ws;
   reduce(r, x, ws);
   return r;
}

BigInt Modular_Reducer::square(const BigInt& x) const {
   secure_vector<word> ws;
   BigInt x2 = x;
   x2.square(ws);
   BigInt r;
   reduce(r, x2, ws);
   return r;
}

namespace {

/*
* Like if(cnd) x.rev_sub(...) but in const time
*/
void cnd_rev_sub(bool cnd, BigInt& x, const word y[], size_t y_sw, secure_vector<word>& ws) {
   if(x.sign() != BigInt::Positive) {
      throw Invalid_State("BigInt::sub_rev requires this is positive");
   }

   const size_t x_sw = x.sig_words();

   const size_t max_words = std::max(x_sw, y_sw);
   ws.resize(std::max(x_sw, y_sw));
   clear_mem(ws.data(), ws.size());
   x.grow_to(max_words);

   const int32_t relative_size = bigint_sub_abs(ws.data(), x._data(), x_sw, y, y_sw);

   x.cond_flip_sign((relative_size > 0) && cnd);
   bigint_cnd_swap(static_cast<word>(cnd), x.mutable_data(), ws.data(), max_words);
}

}  // namespace

void Modular_Reducer::reduce(BigInt& t1, const BigInt& x, secure_vector<word>& ws) const {
   if(&t1 == &x) {
      throw Invalid_State("Modular_Reducer arguments cannot alias");
   }
   if(m_mod_words == 0) {
      throw Invalid_State("Modular_Reducer: Never initalized");
   }

   const size_t x_sw = x.sig_words();

   if(x_sw > 2 * m_mod_words) {
      // too big, fall back to slow boat division
      t1 = ct_modulo(x, m_modulus);
      return;
   }

   t1 = x;
   t1.set_sign(BigInt::Positive);
   t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words - 1));

   t1.mul(m_mu, ws);
   t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words + 1));

   // TODO add masked mul to avoid computing high bits
   t1.mul(m_modulus, ws);
   t1.mask_bits(BOTAN_MP_WORD_BITS * (m_mod_words + 1));

   t1.rev_sub(x._data(), std::min(x_sw, m_mod_words + 1), ws);

   /*
   * If t1 < 0 then we must add b^(k+1) where b = 2^w. To avoid a
   * side channel perform the addition unconditionally, with ws set
   * to either b^(k+1) or else 0.
   */
   const word t1_neg = t1.is_negative();

   if(ws.size() < m_mod_words + 2) {
      ws.resize(m_mod_words + 2);
   }
   clear_mem(ws.data(), ws.size());
   ws[m_mod_words + 1] = t1_neg;

   t1.add(ws.data(), m_mod_words + 2, BigInt::Positive);

   // Per HAC this step requires at most 2 subtractions
   t1.ct_reduce_below(m_modulus, ws, 2);

   cnd_rev_sub(t1.is_nonzero() && x.is_negative(), t1, m_modulus._data(), m_modulus.size(), ws);
}

}  // namespace Botan

1	/*
2	* Modular Reducer
3	* (C) 1999-2011,2018 Jack Lloyd
4	*
5	* Botan is released under the Simplified BSD License (see license.txt)
6	*/
7
8	#include <botan/reducer.h>
9
10	#include <botan/internal/ct_utils.h>
11	#include <botan/internal/divide.h>
12	#include <botan/internal/mp_core.h>
13
14	namespace Botan {
15
16	/*
17	* Modular_Reducer Constructor
18	*/
19	Modular_Reducer::Modular_Reducer(const BigInt& mod) {	1,028✔
20	if(mod < 0) {	1,028✔
21	throw Invalid_Argument("Modular_Reducer: modulus must be positive");	×
22	}
23
24	// Left uninitialized if mod == 0
25	m_mod_words = 0;	1,028✔
26
27	if(mod > 0) {	1,028✔
28	*this = Modular_Reducer::for_secret_modulus(mod);	1,028✔
29	}
30	}	1,028✔
31
32	Modular_Reducer Modular_Reducer::for_secret_modulus(const BigInt& mod) {	47,066✔
33	BOTAN_ARG_CHECK(!mod.is_zero(), "Modulus cannot be zero");	67,553✔
34	BOTAN_ARG_CHECK(!mod.is_negative(), "Modulus cannot be negative");	47,066✔
35
36	size_t mod_words = mod.sig_words();	47,066✔
37
38	// Compute mu = floor(2^{2k} / m)
39	const size_t mu_bits = 2 * BOTAN_MP_WORD_BITS * mod_words;	47,066✔
40	return Modular_Reducer(mod, ct_divide_pow2k(mu_bits, mod), mod_words);	94,132✔
41	}
42
43	Modular_Reducer Modular_Reducer::for_public_modulus(const BigInt& mod) {	77,335✔
44	BOTAN_ARG_CHECK(!mod.is_zero(), "Modulus cannot be zero");	131,641✔
45	BOTAN_ARG_CHECK(!mod.is_negative(), "Modulus cannot be negative");	77,269✔
46
47	size_t mod_words = mod.sig_words();	77,262✔
48
49	// Compute mu = floor(2^{2k} / m)
50	const size_t mu_bits = 2 * BOTAN_MP_WORD_BITS * mod_words;	77,262✔
51	return Modular_Reducer(mod, BigInt::power_of_2(mu_bits) / mod, mod_words);	231,786✔
52	}
53
54	BigInt Modular_Reducer::reduce(const BigInt& x) const {	6,436,633✔
55	BigInt r;	6,436,633✔
56	secure_vector<word> ws;	6,436,633✔
57	reduce(r, x, ws);	6,436,633✔
58	return r;	6,436,633✔
59	}	6,436,633✔
60
61	BigInt Modular_Reducer::square(const BigInt& x) const {	2,309,181✔
62	secure_vector<word> ws;	2,309,181✔
63	BigInt x2 = x;	2,309,181✔
64	x2.square(ws);	2,309,181✔
65	BigInt r;	2,309,181✔
66	reduce(r, x2, ws);	2,309,181✔
67	return r;	2,309,181✔
68	}	4,618,362✔
69
70	namespace {
71
72	/*
73	* Like if(cnd) x.rev_sub(...) but in const time
74	*/
75	void cnd_rev_sub(bool cnd, BigInt& x, const word y[], size_t y_sw, secure_vector<word>& ws) {	8,741,450✔
76	if(x.sign() != BigInt::Positive) {	8,741,450✔
77	throw Invalid_State("BigInt::sub_rev requires this is positive");	×
78	}
79
80	const size_t x_sw = x.sig_words();	8,741,450✔
81
82	const size_t max_words = std::max(x_sw, y_sw);	8,741,450✔
83	ws.resize(std::max(x_sw, y_sw));	8,741,450✔
84	clear_mem(ws.data(), ws.size());	8,741,450✔
85	x.grow_to(max_words);	8,741,450✔
86
87	const int32_t relative_size = bigint_sub_abs(ws.data(), x._data(), x_sw, y, y_sw);	8,741,450✔
88
89	x.cond_flip_sign((relative_size > 0) && cnd);	8,741,450✔
90	bigint_cnd_swap(static_cast<word>(cnd), x.mutable_data(), ws.data(), max_words);	8,741,450✔
91	}	8,741,450✔
92
93	} // namespace
94
95	void Modular_Reducer::reduce(BigInt& t1, const BigInt& x, secure_vector<word>& ws) const {	8,745,814✔
96	if(&t1 == &x) {	8,745,814✔
97	throw Invalid_State("Modular_Reducer arguments cannot alias");	×
98	}
99	if(m_mod_words == 0) {	8,745,814✔
100	throw Invalid_State("Modular_Reducer: Never initalized");	×
101	}
102
103	const size_t x_sw = x.sig_words();	8,745,814✔
104
105	if(x_sw > 2 * m_mod_words) {	8,745,814✔
106	// too big, fall back to slow boat division
107	t1 = ct_modulo(x, m_modulus);	4,364✔
108	return;	4,364✔
109	}
110
111	t1 = x;	8,741,450✔
112	t1.set_sign(BigInt::Positive);	8,741,450✔
113	t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words - 1));	8,741,450✔
114
115	t1.mul(m_mu, ws);	8,741,450✔
116	t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words + 1));	8,741,450✔
117
118	// TODO add masked mul to avoid computing high bits
119	t1.mul(m_modulus, ws);	8,741,450✔
120	t1.mask_bits(BOTAN_MP_WORD_BITS * (m_mod_words + 1));	8,741,450✔
121
122	t1.rev_sub(x._data(), std::min(x_sw, m_mod_words + 1), ws);	10,465,653✔
123
124	/*
125	* If t1 < 0 then we must add b^(k+1) where b = 2^w. To avoid a
126	* side channel perform the addition unconditionally, with ws set
127	* to either b^(k+1) or else 0.
128	*/
129	const word t1_neg = t1.is_negative();	8,741,450✔
130
131	if(ws.size() < m_mod_words + 2) {	8,741,450✔
132	ws.resize(m_mod_words + 2);	36,388✔
133	}
134	clear_mem(ws.data(), ws.size());	8,741,450✔
135	ws[m_mod_words + 1] = t1_neg;	8,741,450✔
136
137	t1.add(ws.data(), m_mod_words + 2, BigInt::Positive);	8,741,450✔
138
139	// Per HAC this step requires at most 2 subtractions
140	t1.ct_reduce_below(m_modulus, ws, 2);	8,741,450✔
141
142	cnd_rev_sub(t1.is_nonzero() && x.is_negative(), t1, m_modulus._data(), m_modulus.size(), ws);	25,337,552✔
143	}
144
145	} // namespace Botan

randombit / botan / 13014411529

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous