Commit c84e2c87 authored by Benoit Viguier's avatar Benoit Viguier
Browse files

fix packing + more writing

parent 1e83eaa3
...@@ -37,9 +37,11 @@ coq-tweetnacl-vst: coq-tweetnacl-spec .building2 ...@@ -37,9 +37,11 @@ coq-tweetnacl-vst: coq-tweetnacl-spec .building2
clean-vst: P=proofs/vst clean-vst: P=proofs/vst
clean-vst: .dusting2 clean-vst: .dusting2
.PHONY: clean
clean: clean-spec clean-vst clean-dist clean: clean-spec clean-vst clean-dist
# build paper # build paper
.PHONY: paper
paper: paper:
cd paper && $(MAKE) cd paper && $(MAKE)
......
...@@ -305,25 +305,25 @@ In the case of X25519, $n$ is the private key. With the Montgomery's ladder, whi ...@@ -305,25 +305,25 @@ In the case of X25519, $n$ is the private key. With the Montgomery's ladder, whi
it provides slightly more computations and an extra variable, we can prevent such weakness. it provides slightly more computations and an extra variable, we can prevent such weakness.
See Algorithm \ref{montgomery-ladder}. See Algorithm \ref{montgomery-ladder}.
\begin{algorithm} % \begin{algorithm}
\caption{Montgomery ladder for scalar mult.} % \caption{Montgomery ladder for scalar mult.}
\label{montgomery-ladder} % \label{montgomery-ladder}
\begin{algorithmic} % \begin{algorithmic}
\REQUIRE{Point $P$, scalars $n$ and $m$, $n < 2^m$} % \REQUIRE{Point $P$, scalars $n$ and $m$, $n < 2^m$}
\ENSURE{$Q = n \cdot P$} % \ENSURE{$Q = n \cdot P$}
\STATE $Q \leftarrow \Oinf$ % \STATE $Q \leftarrow \Oinf$
\STATE $R \leftarrow P$ % \STATE $R \leftarrow P$
\FOR{$k$ := $m$ downto $1$} % \FOR{$k$ := $m$ downto $1$}
\IF{$k^{\text{th}}$ bit of $n$ is $0$} % \IF{$k^{\text{th}}$ bit of $n$ is $0$}
\STATE $R \leftarrow Q + R$ % \STATE $R \leftarrow Q + R$
\STATE $Q \leftarrow 2Q$ % \STATE $Q \leftarrow 2Q$
\ELSE % \ELSE
\STATE $Q \leftarrow Q + R$ % \STATE $Q \leftarrow Q + R$
\STATE $R \leftarrow 2R$ % \STATE $R \leftarrow 2R$
\ENDIF % \ENDIF
\ENDFOR % \ENDFOR
\end{algorithmic} % \end{algorithmic}
\end{algorithm} % \end{algorithm}
\begin{lemma} \begin{lemma}
\label{lemma-montgomery-ladder} \label{lemma-montgomery-ladder}
......
...@@ -41,19 +41,11 @@ such coordinates are represented as $X/Z$ fractions. We define two operations: ...@@ -41,19 +41,11 @@ such coordinates are represented as $X/Z$ fractions. We define two operations:
\texttt{xADD} &: (X_P, Z_P, X_Q , Z_Q, X_{P-Q}, Z_{P-Q}) \mapsto (X_{P+Q}, Z_{P+Q})\\ \texttt{xADD} &: (X_P, Z_P, X_Q , Z_Q, X_{P-Q}, Z_{P-Q}) \mapsto (X_{P+Q}, Z_{P+Q})\\
\texttt{xDBL} &: (X_P, Z_P) \mapsto (X_{2P}, Z_{2P})\\ \texttt{xDBL} &: (X_P, Z_P) \mapsto (X_{2P}, Z_{2P})\\
\end{align*} \end{align*}
To remove secret-dependent if-statements we use a constant-time conditional swap In the Montgomery, notice that the arguments of \texttt{xADD} and \texttt{xDBL}
(see Algorithm~\ref{c-swap}). are swapped depending of the value of the $k^{th}$ bit. We use a conditional
\begin{algorithm} swap \texttt{CSWAP} to change the arguments of the above function. This while keeping the same body of the loop.
\caption{\texttt{SWAP} : Constant-time conditional swap} Given a pair $(X_0, X_1)$ and a boolean $b$, \texttt{CSWAP} returns the pair
\label{c-swap} $(X_b, X_{1-b})$.
\begin{algorithmic}
\REQUIRE{$b \in \{0, 1\}$ and a pair $(X_0, X_1)$ of objects encoded as $n$-bit strings}
\ENSURE{$(X_b, X_{1-b})$}
\STATE $B \leftarrow (b, \ldots, b)_n$
\STATE $Mask \leftarrow B \texttt{ AND } (X_0\texttt{ XOR } X_1)$
\RETURN $(X_0 \texttt{ XOR } Mask, X_1 \texttt{ XOR } Mask)$
\end{algorithmic}
\end{algorithm}
By using the differential addition and doubling operations we define the Montgomery ladder By using the differential addition and doubling operations we define the Montgomery ladder
computing a $x$-coordinate-only scalar multiplication (see Algorithm~\ref{montgomery-ladder}). computing a $x$-coordinate-only scalar multiplication (see Algorithm~\ref{montgomery-ladder}).
...@@ -66,10 +58,10 @@ computing a $x$-coordinate-only scalar multiplication (see Algorithm~\ref{montgo ...@@ -66,10 +58,10 @@ computing a $x$-coordinate-only scalar multiplication (see Algorithm~\ref{montgo
\STATE $Q \leftarrow \Oinf$ \STATE $Q \leftarrow \Oinf$
\STATE $R \leftarrow (X_P,Z_P)$ \STATE $R \leftarrow (X_P,Z_P)$
\FOR{$k$ := $m$ down to $1$} \FOR{$k$ := $m$ down to $1$}
\STATE $(Q,R) \leftarrow \texttt{SWAP}(k^{\text{th}}\text{ bit of }n, (Q,R))$ \STATE $(Q,R) \leftarrow \texttt{SWAP}((Q,R), k^{\text{th}}\text{ bit of }n)$
\STATE $Q \leftarrow \texttt{xDBL}(Q)$ \STATE $Q \leftarrow \texttt{xDBL}(Q)$
\STATE $R \leftarrow \texttt{xADD}(Q,R,X_P,Z_P)$ \STATE $R \leftarrow \texttt{xADD}(Q,R,X_P,Z_P)$
\STATE $(Q,R) \leftarrow \texttt{SWAP}(k^{\text{th}}\text{ bit of }n, (Q,R))$ \STATE $(Q,R) \leftarrow \texttt{SWAP}((Q,R), k^{\text{th}}\text{ bit of }n)$
\ENDFOR \ENDFOR
\RETURN $Q$ \RETURN $Q$
\end{algorithmic} \end{algorithmic}
...@@ -212,20 +204,20 @@ It takes the exponentiation by $2^{255}-21$ with the Square-and-multiply algorit ...@@ -212,20 +204,20 @@ It takes the exponentiation by $2^{255}-21$ with the Square-and-multiply algorit
Fermat's little theorem brings the correctness. Fermat's little theorem brings the correctness.
Notice that in this case the inverse of $0$ is defined as $0$. Notice that in this case the inverse of $0$ is defined as $0$.
\TNaCle{sel25519} implements a constant-time conditional \texttt{SWAP} (Algorithm~\ref{c-swap}) \TNaCle{sel25519} implements a constant-time conditional \texttt{CSWAP} (Algorithm~\ref{c-swap})
by applying a mask between two fields elements. by applying a mask between two fields elements.
% \begin{lstlisting}[language=Ctweetnacl] \begin{lstlisting}[language=Ctweetnacl]
% sv sel25519(gf p,gf q,i64 b) sv sel25519(gf p,gf q,i64 b)
% { {
% int i; int i;
% i64 t,c=~(b-1); i64 t,c=~(b-1);
% FOR(i,16) { FOR(i,16) {
% t= c&(p[i]^q[i]); t= c&(p[i]^q[i]);
% p[i]^=t; p[i]^=t;
% q[i]^=t; q[i]^=t;
% } }
% } }
% \end{lstlisting} \end{lstlisting}
Finally, we require the \TNaCle{pack25519} function, Finally, we require the \TNaCle{pack25519} function,
which converts from the internal redundant radix-$2^{16}$ which converts from the internal redundant radix-$2^{16}$
......
...@@ -310,7 +310,7 @@ sv pack25519(u8 *o,const gf n) ...@@ -310,7 +310,7 @@ sv pack25519(u8 *o,const gf n)
} }
m[15]=t[15]-0x7fff-((m[14]>>16)&1); m[15]=t[15]-0x7fff-((m[14]>>16)&1);
m[14]&=0xffff; m[14]&=0xffff;
b=1-(m[15]>>16)&1; b=1-((m[15]>>16)&1);
sel25519(t,m,b); sel25519(t,m,b);
} }
FOR(i,16) { FOR(i,16) {
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment