Botan 3.7.1
Crypto and TLS for C&
Botan::EC_Point_Var_Point_Precompute Class Referencefinal

#include <point_mul.h>

Public Member Functions

 EC_Point_Var_Point_Precompute (const EC_Point &point, RandomNumberGenerator &rng, std::vector< BigInt > &ws)
 
EC_Point mul (const BigInt &k, RandomNumberGenerator &rng, const BigInt &group_order, std::vector< BigInt > &ws) const
 

Detailed Description

Definition at line 41 of file point_mul.h.

Constructor & Destructor Documentation

◆ EC_Point_Var_Point_Precompute()

Botan::EC_Point_Var_Point_Precompute::EC_Point_Var_Point_Precompute ( const EC_Point & point,
RandomNumberGenerator & rng,
std::vector< BigInt > & ws )

Definition at line 170 of file point_mul.cpp.

172 :
173 m_curve(ipoint.get_curve()), m_p_words(m_curve.get_p_words()), m_window_bits(4) {
174 if(ws.size() < EC_Point::WORKSPACE_SIZE) {
175 ws.resize(EC_Point::WORKSPACE_SIZE);
176 }
177
178 auto point = ipoint;
179 point.randomize_repr(rng);
180
181 std::vector<EC_Point> U(static_cast<size_t>(1) << m_window_bits);
182 U[0] = point.zero();
183 U[1] = point;
184
185 for(size_t i = 2; i < U.size(); i += 2) {
186 U[i] = U[i / 2].double_of(ws);
187 U[i + 1] = U[i].plus(point, ws);
188 }
189
190 // Hack to handle Blinded_Point_Multiply
191 if(rng.is_seeded()) {
192 // Skipping zero point since it can't be randomized
193 for(size_t i = 1; i != U.size(); ++i) {
194 U[i].randomize_repr(rng);
195 }
196 }
197
198 m_T.resize(U.size() * 3 * m_p_words);
199
200 word* p = &m_T[0];
201 for(size_t i = 0; i != U.size(); ++i) {
202 U[i].get_x().encode_words(p, m_p_words);
203 U[i].get_y().encode_words(p + m_p_words, m_p_words);
204 U[i].get_z().encode_words(p + 2 * m_p_words, m_p_words);
205 p += 3 * m_p_words;
206 }
207}
size_t get_p_words() const
Definition ec_point.cpp:44

References Botan::RandomNumberGenerator::is_seeded(), Botan::EC_Point::randomize_repr(), and Botan::EC_Point::WORKSPACE_SIZE.

Member Function Documentation

◆ mul()

EC_Point Botan::EC_Point_Var_Point_Precompute::mul ( const BigInt & k,
RandomNumberGenerator & rng,
const BigInt & group_order,
std::vector< BigInt > & ws ) const

Definition at line 209 of file point_mul.cpp.

212 {
213 if(k.is_negative()) {
214 throw Invalid_Argument("EC_Point_Var_Point_Precompute scalar must be positive");
215 }
216 if(ws.size() < EC_Point::WORKSPACE_SIZE) {
217 ws.resize(EC_Point::WORKSPACE_SIZE);
218 }
219
220 // Choose a small mask m and use k' = k + m*order (Coron's 1st countermeasure)
221 const BigInt scalar = k + group_order * blinding_mask(group_order, rng);
222
223 const size_t elem_size = 3 * m_p_words;
224 const size_t window_elems = static_cast<size_t>(1) << m_window_bits;
225
226 size_t windows = round_up(scalar.bits(), m_window_bits) / m_window_bits;
227 EC_Point R(m_curve);
228 secure_vector<word> e(elem_size);
229
230 if(windows > 0) {
231 windows--;
232
233 const uint32_t w = scalar.get_substring(windows * m_window_bits, m_window_bits);
234
235 clear_mem(e.data(), e.size());
236 for(size_t i = 1; i != window_elems; ++i) {
237 const auto wmask = CT::Mask<word>::is_equal(w, i);
238
239 for(size_t j = 0; j != elem_size; ++j) {
240 e[j] |= wmask.if_set_return(m_T[i * elem_size + j]);
241 }
242 }
243
244 R.add(&e[0], m_p_words, &e[m_p_words], m_p_words, &e[2 * m_p_words], m_p_words, ws);
245
246 /*
247 Randomize after adding the first nibble as before the addition R
248 is zero, and we cannot effectively randomize the point
249 representation of the zero point.
250 */
251 R.randomize_repr(rng, ws[0].get_word_vector());
252 }
253
254 while(windows) {
255 R.mult2i(m_window_bits, ws);
256
257 const uint32_t w = scalar.get_substring((windows - 1) * m_window_bits, m_window_bits);
258
259 clear_mem(e.data(), e.size());
260 for(size_t i = 1; i != window_elems; ++i) {
261 const auto wmask = CT::Mask<word>::is_equal(w, i);
262
263 for(size_t j = 0; j != elem_size; ++j) {
264 e[j] |= wmask.if_set_return(m_T[i * elem_size + j]);
265 }
266 }
267
268 R.add(&e[0], m_p_words, &e[m_p_words], m_p_words, &e[2 * m_p_words], m_p_words, ws);
269
270 windows--;
271 }
272
273 BOTAN_ASSERT_NOMSG(R.on_the_curve());
274
275 return R;
276}
#define BOTAN_ASSERT_NOMSG(expr)
Definition assert.h:59
static constexpr Mask< T > is_equal(T x, T y)
Definition ct_utils.h:453
constexpr size_t round_up(size_t n, size_t align_to)
Definition rounding.h:25
std::vector< T, secure_allocator< T > > secure_vector
Definition secmem.h:61
constexpr void clear_mem(T *ptr, size_t n)
Definition mem_ops.h:121

References Botan::EC_Point::add(), Botan::BigInt::bits(), BOTAN_ASSERT_NOMSG, Botan::clear_mem(), Botan::BigInt::get_substring(), Botan::BigInt::is_negative(), Botan::EC_Point::mult2i(), Botan::EC_Point::on_the_curve(), Botan::EC_Point::randomize_repr(), and Botan::round_up().

Referenced by Botan::EC_Group_Data::mul_px_qy().


The documentation for this class was generated from the following files: