Botan 3.8.1
Crypto and TLS for C&
Botan::EC_Point_Var_Point_Precompute Class Referencefinal

#include <point_mul.h>

Public Member Functions

 EC_Point_Var_Point_Precompute (const EC_Point &point, RandomNumberGenerator &rng, std::vector< BigInt > &ws)
 
EC_Point mul (const BigInt &k, RandomNumberGenerator &rng, const BigInt &group_order, std::vector< BigInt > &ws) const
 

Detailed Description

Definition at line 41 of file point_mul.h.

Constructor & Destructor Documentation

◆ EC_Point_Var_Point_Precompute()

Botan::EC_Point_Var_Point_Precompute::EC_Point_Var_Point_Precompute ( const EC_Point & point,
RandomNumberGenerator & rng,
std::vector< BigInt > & ws )

Definition at line 172 of file point_mul.cpp.

174 :
175 m_curve(ipoint.get_curve()), m_p_words(m_curve.get_p_words()), m_window_bits(4) {
176 if(ws.size() < EC_Point::WORKSPACE_SIZE) {
177 ws.resize(EC_Point::WORKSPACE_SIZE);
178 }
179
180 auto point = ipoint;
181 point.randomize_repr(rng);
182
183 std::vector<EC_Point> U(static_cast<size_t>(1) << m_window_bits);
184 U[0] = point.zero();
185 U[1] = point;
186
187 for(size_t i = 2; i < U.size(); i += 2) {
188 U[i] = U[i / 2].double_of(ws);
189 U[i + 1] = U[i].plus(point, ws);
190 }
191
192 // Hack to handle Blinded_Point_Multiply
193 if(rng.is_seeded()) {
194 // Skipping zero point since it can't be randomized
195 for(size_t i = 1; i != U.size(); ++i) {
196 U[i].randomize_repr(rng);
197 }
198 }
199
200 m_T.resize(U.size() * 3 * m_p_words);
201
202 word* p = &m_T[0];
203 for(size_t i = 0; i != U.size(); ++i) {
204 U[i].get_x().encode_words(p, m_p_words);
205 U[i].get_y().encode_words(p + m_p_words, m_p_words);
206 U[i].get_z().encode_words(p + 2 * m_p_words, m_p_words);
207 p += 3 * m_p_words;
208 }
209}
std::conditional_t< HasNative64BitRegisters, std::uint64_t, uint32_t > word
Definition types.h:119

References Botan::RandomNumberGenerator::is_seeded(), Botan::EC_Point::randomize_repr(), and Botan::EC_Point::WORKSPACE_SIZE.

Member Function Documentation

◆ mul()

EC_Point Botan::EC_Point_Var_Point_Precompute::mul ( const BigInt & k,
RandomNumberGenerator & rng,
const BigInt & group_order,
std::vector< BigInt > & ws ) const

Definition at line 211 of file point_mul.cpp.

214 {
215 if(k.is_negative()) {
216 throw Invalid_Argument("EC_Point_Var_Point_Precompute scalar must be positive");
217 }
218 if(ws.size() < EC_Point::WORKSPACE_SIZE) {
219 ws.resize(EC_Point::WORKSPACE_SIZE);
220 }
221
222 // Choose a small mask m and use k' = k + m*order (Coron's 1st countermeasure)
223 const BigInt scalar = k + group_order * blinding_mask(group_order, rng);
224
225 const size_t elem_size = 3 * m_p_words;
226 const size_t window_elems = static_cast<size_t>(1) << m_window_bits;
227
228 size_t windows = round_up(scalar.bits(), m_window_bits) / m_window_bits;
229 EC_Point R(m_curve);
230 secure_vector<word> e(elem_size);
231
232 if(windows > 0) {
233 windows--;
234
235 const uint32_t w = scalar.get_substring(windows * m_window_bits, m_window_bits);
236
237 clear_mem(e.data(), e.size());
238 for(size_t i = 1; i != window_elems; ++i) {
239 const auto wmask = CT::Mask<word>::is_equal(w, i);
240
241 for(size_t j = 0; j != elem_size; ++j) {
242 e[j] |= wmask.if_set_return(m_T[i * elem_size + j]);
243 }
244 }
245
246 R.add(&e[0], m_p_words, &e[m_p_words], m_p_words, &e[2 * m_p_words], m_p_words, ws);
247
248 /*
249 Randomize after adding the first nibble as before the addition R
250 is zero, and we cannot effectively randomize the point
251 representation of the zero point.
252 */
253 R.randomize_repr(rng, ws[0].get_word_vector());
254 }
255
256 while(windows) {
257 R.mult2i(m_window_bits, ws);
258
259 const uint32_t w = scalar.get_substring((windows - 1) * m_window_bits, m_window_bits);
260
261 clear_mem(e.data(), e.size());
262 for(size_t i = 1; i != window_elems; ++i) {
263 const auto wmask = CT::Mask<word>::is_equal(w, i);
264
265 for(size_t j = 0; j != elem_size; ++j) {
266 e[j] |= wmask.if_set_return(m_T[i * elem_size + j]);
267 }
268 }
269
270 R.add(&e[0], m_p_words, &e[m_p_words], m_p_words, &e[2 * m_p_words], m_p_words, ws);
271
272 windows--;
273 }
274
275 BOTAN_ASSERT_NOMSG(R.on_the_curve());
276
277 return R;
278}
#define BOTAN_ASSERT_NOMSG(expr)
Definition assert.h:61
static constexpr Mask< T > is_equal(T x, T y)
Definition ct_utils.h:454
constexpr size_t round_up(size_t n, size_t align_to)
Definition rounding.h:26
std::vector< T, secure_allocator< T > > secure_vector
Definition secmem.h:65
constexpr void clear_mem(T *ptr, size_t n)
Definition mem_ops.h:123

References Botan::EC_Point::add(), Botan::BigInt::bits(), BOTAN_ASSERT_NOMSG, Botan::clear_mem(), Botan::BigInt::get_substring(), Botan::CT::Mask< T >::is_equal(), Botan::BigInt::is_negative(), mul(), Botan::EC_Point::mult2i(), Botan::EC_Point::on_the_curve(), Botan::EC_Point::randomize_repr(), Botan::round_up(), and Botan::EC_Point::WORKSPACE_SIZE.

Referenced by mul(), and Botan::EC_Group_Data::mul_px_qy().


The documentation for this class was generated from the following files: