Skip to content

Commit 4a13b2a

Browse files
ctzctz
committed
Correct misuse of wNAF terminology
1 parent 94c8ecf commit 4a13b2a

File tree

5 files changed

+49
-51
lines changed

5 files changed

+49
-51
lines changed

‎README.md

+7-3
Original file line numberDiff line numberDiff line change
@@ -108,13 +108,17 @@ Only RSA signing and verification are provided. Our policy on RSA encryption is
108108
### ECC
109109
All ECC field and scalar arithmetic are provided by s2n-bignum.
110110

111-
P256 base point multiplication uses 7-bit exponent window in wNAF form (this costs a 148KB constant table).
112-
Variable point multiplication uses a 5-bit exponent window in wNAF form.
111+
P256 base point multiplication uses a 7-bit exponent window with Booth encoding
112+
(this costs a 148KB constant table).
113+
Variable point multiplication uses a 5-bit exponent window with Booth encoding.
113114

114-
P384 base and variable point multiplication both use a 5-bit exponent window in wNAF form.
115+
P384 base and variable point multiplication both use a 5-bit exponent window with Booth encoding.
115116
(This means we're leaving a some P384 base point performance on the table, in exchange for code space.
116117
P384 performance seems to be less important than P256.)
117118

119+
Both use the same exponent representations for "public" and "secret" exponents --
120+
however the table selection for "public" exponents is specialized at compile-time.
121+
118122
ECDSA follows RFC6979 for generation of `k`, but adds additional non-critical random input.
119123
We do this to avoid the theoretical fragility of RFC6979 under fault conditions.
120124
This is allowed for by RFC6979, and the HMAC-DRBG that it builds on.

‎graviola/src/mid/p256.rs

+23-28
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ mod precomp;
1515
#[derive(Clone, Debug)]
1616
pub struct PublicKey {
1717
point: AffineMontPoint,
18-
precomp_wnaf_5: JacobianMontPointTableW5,
18+
precomp_w5: JacobianMontPointTableW5,
1919
}
2020

2121
impl PublicKey {
@@ -40,7 +40,7 @@ impl PublicKey {
4040

4141
fn from_affine(point: AffineMontPoint) -> Self {
4242
Self {
43-
precomp_wnaf_5: point.public_precomp_wnaf_5(),
43+
precomp_w5: point.public_precomp_w5(),
4444
point,
4545
}
4646
}
@@ -54,7 +54,7 @@ impl PublicKey {
5454
// 5. Compute: R = (xR, yR) = u1 G + u2 QU
5555
// If R = O, output "invalid" and stop.
5656
let lhs = JacobianMontPoint::public_base_multiply(&u1);
57-
let rhs = JacobianMontPoint::public_multiply_wnaf_5(&u2, &self.precomp_wnaf_5);
57+
let rhs = JacobianMontPoint::public_multiply_w5(&u2, &self.precomp_w5);
5858

5959
// nb. if lhs == rhs, then we need a doubling rather than addition
6060
// (even complete point addition formula is only defined for P != Q)
@@ -109,8 +109,7 @@ impl PrivateKey {
109109
/// Returns a [`SharedSecret`]. May return an error in fault conditions.
110110
pub fn diffie_hellman(self, peer: &PublicKey) -> Result<SharedSecret, Error> {
111111
let _entry = low::Entry::new_secret();
112-
let result =
113-
JacobianMontPoint::multiply_wnaf_5(&self.scalar, &peer.precomp_wnaf_5).as_affine();
112+
let result = JacobianMontPoint::multiply_w5(&self.scalar, &peer.precomp_w5).as_affine();
114113
match result.on_curve() {
115114
true => Ok(SharedSecret(util::u64x4_to_big_endian(
116115
&result.x().demont().0,
@@ -351,18 +350,19 @@ impl AffineMontPoint {
351350
self.xy[Self::Y].copy_from_slice(&result.0);
352351
}
353352

354-
/// Precomputes wNAF form (with 𝑤=6) for the point `self`
353+
/// Precomputes a table (with 𝑤=6) for the point `self`
355354
///
356355
/// 64 is the row size, 2**6.
357-
/// 37 is the table height, ceil(256/7) (wNAF gives us one bit
358-
/// extra free, in exchange for a negation to compute a negative
359-
/// point from the precomputed positive point -- this is ~free).
356+
/// 37 is the table height, ceil(256/7) (Booth encoding gives us
357+
/// one bit extra free, in exchange for a negation to compute a
358+
/// negative point from the precomputed positive point -- this is
359+
/// ~free).
360360
///
361361
/// This should not be used at runtime, since (for brevity) it
362362
/// does excessive point representation conversions, and recomputes
363-
/// items in a given row several times (compare `public_precomp_wnaf_5`).
363+
/// items in a given row several times (compare `public_precomp_w5`).
364364
#[cfg(test)]
365-
fn public_precomp_wnaf_7_slow(&self) -> [[Self; 64]; 37] {
365+
fn public_precomp_w7_slow(&self) -> [[Self; 64]; 37] {
366366
let mut r = [[Self::default(); 64]; 37];
367367

368368
for window in 0..((256 + 6) / 7) {
@@ -382,7 +382,7 @@ impl AffineMontPoint {
382382
r
383383
}
384384

385-
fn public_precomp_wnaf_5(&self) -> JacobianMontPointTableW5 {
385+
fn public_precomp_w5(&self) -> JacobianMontPointTableW5 {
386386
let mut r = [JacobianMontPoint::zero(); 16];
387387

388388
// indices into r are intuitively 1-based; index i contains i * G,
@@ -491,17 +491,14 @@ impl JacobianMontPoint {
491491
}
492492

493493
fn base_multiply(scalar: &Scalar) -> Self {
494-
Self::multiply_wnaf_7::<true>(scalar, &precomp::CURVE_GENERATOR_PRECOMP_WNAF_7)
494+
Self::multiply_w7::<true>(scalar, &precomp::CURVE_GENERATOR_PRECOMP_W7)
495495
}
496496

497497
fn public_base_multiply(scalar: &Scalar) -> Self {
498-
Self::multiply_wnaf_7::<false>(scalar, &precomp::CURVE_GENERATOR_PRECOMP_WNAF_7)
498+
Self::multiply_w7::<false>(scalar, &precomp::CURVE_GENERATOR_PRECOMP_W7)
499499
}
500500

501-
fn multiply_wnaf_7<const SECRET: bool>(
502-
scalar: &Scalar,
503-
precomp: &AffineMontPointTableW7,
504-
) -> Self {
501+
fn multiply_w7<const SECRET: bool>(scalar: &Scalar, precomp: &AffineMontPointTableW7) -> Self {
505502
let mut terms = scalar.booth_recoded_w7();
506503
// unwrap: number of terms is constant
507504
let (digit, sign) = terms.next().unwrap();
@@ -545,15 +542,15 @@ impl JacobianMontPoint {
545542
result
546543
}
547544

548-
fn multiply_wnaf_5(scalar: &Scalar, precomp: &JacobianMontPointTableW5) -> Self {
549-
Self::_multiply_wnaf_5::<true>(scalar, precomp)
545+
fn multiply_w5(scalar: &Scalar, precomp: &JacobianMontPointTableW5) -> Self {
546+
Self::_multiply_w5::<true>(scalar, precomp)
550547
}
551548

552-
fn public_multiply_wnaf_5(scalar: &Scalar, precomp: &JacobianMontPointTableW5) -> Self {
553-
Self::_multiply_wnaf_5::<false>(scalar, precomp)
549+
fn public_multiply_w5(scalar: &Scalar, precomp: &JacobianMontPointTableW5) -> Self {
550+
Self::_multiply_w5::<false>(scalar, precomp)
554551
}
555552

556-
fn _multiply_wnaf_5<const SECRET: bool>(
553+
fn _multiply_w5<const SECRET: bool>(
557554
scalar: &Scalar,
558555
precomp: &JacobianMontPointTableW5,
559556
) -> Self {
@@ -1256,12 +1253,10 @@ mod tests {
12561253
}
12571254

12581255
#[test]
1259-
fn base_point_precomp_wnaf_7() {
1260-
let precomp = CURVE_GENERATOR.public_precomp_wnaf_7_slow();
1256+
fn base_point_precomp_w7() {
1257+
let precomp = CURVE_GENERATOR.public_precomp_w7_slow();
12611258

1262-
println!(
1263-
"pub(super) static CURVE_GENERATOR_PRECOMP_WNAF_7: super::AffineMontPointTableW7 = ["
1264-
);
1259+
println!("pub(super) static CURVE_GENERATOR_PRECOMP_W7: super::AffineMontPointTableW7 = [");
12651260
for w in 0..37 {
12661261
println!(" // 1G..64G << {}", w * 7);
12671262
println!(" [");

‎graviola/src/mid/p256/precomp.rs

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
// This file is autogenerated, run
2-
// `cargo test p256::base_point_precomp_wnaf_7`
2+
// `cargo test p256::base_point_precomp_w7`
33
// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0
44

5-
pub(super) static CURVE_GENERATOR_PRECOMP_WNAF_7: super::AffineMontPointTableW7 = [
5+
pub(super) static CURVE_GENERATOR_PRECOMP_W7: super::AffineMontPointTableW7 = [
66
// 1G..64G << 0
77
[
88
0x79e730d418a9143c,

‎graviola/src/mid/p384.rs

+15-16
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ mod precomp;
1515
#[derive(Clone, Debug)]
1616
pub struct PublicKey {
1717
point: AffineMontPoint,
18-
precomp_wnaf_5: JacobianMontPointTableW5,
18+
precomp_w5: JacobianMontPointTableW5,
1919
}
2020

2121
impl PublicKey {
@@ -40,7 +40,7 @@ impl PublicKey {
4040

4141
fn from_affine(point: AffineMontPoint) -> Self {
4242
Self {
43-
precomp_wnaf_5: point.public_precomp_wnaf_5(),
43+
precomp_w5: point.public_precomp_w5(),
4444
point,
4545
}
4646
}
@@ -54,7 +54,7 @@ impl PublicKey {
5454
// 5. Compute: R = (xR, yR) = u1 G + u2 QU
5555
// If R = O, output "invalid" and stop.
5656
let lhs = JacobianMontPoint::public_base_multiply(&u1);
57-
let rhs = JacobianMontPoint::public_multiply_wnaf_5(&u2, &self.precomp_wnaf_5);
57+
let rhs = JacobianMontPoint::public_multiply_w5(&u2, &self.precomp_w5);
5858

5959
// nb. if lhs == rhs, then we need a doubling rather than addition
6060
// (even complete point addition formula is only defined for P != Q)
@@ -110,8 +110,7 @@ impl PrivateKey {
110110
/// Returns a [`SharedSecret`]. May return an error in fault conditions.
111111
pub fn diffie_hellman(self, peer: &PublicKey) -> Result<SharedSecret, Error> {
112112
let _entry = low::Entry::new_secret();
113-
let result =
114-
JacobianMontPoint::multiply_wnaf_5(&self.scalar, &peer.precomp_wnaf_5).as_affine();
113+
let result = JacobianMontPoint::multiply_w5(&self.scalar, &peer.precomp_w5).as_affine();
115114
match result.on_curve() {
116115
true => Ok(SharedSecret(util::u64x6_to_big_endian(
117116
&result.x().demont().0,
@@ -330,7 +329,7 @@ impl AffineMontPoint {
330329
.as_affine()
331330
}
332331

333-
fn public_precomp_wnaf_5(&self) -> JacobianMontPointTableW5 {
332+
fn public_precomp_w5(&self) -> JacobianMontPointTableW5 {
334333
let mut r = [JacobianMontPoint::zero(); 16];
335334

336335
// indices into r are intuitively 1-based; index i contains i * G,
@@ -421,22 +420,22 @@ impl JacobianMontPoint {
421420
}
422421

423422
fn base_multiply(scalar: &Scalar) -> Self {
424-
Self::multiply_wnaf_5(scalar, &precomp::CURVE_GENERATOR_PRECOMP_WNAF_5)
423+
Self::multiply_w5(scalar, &precomp::CURVE_GENERATOR_PRECOMP_W5)
425424
}
426425

427426
fn public_base_multiply(scalar: &Scalar) -> Self {
428-
Self::public_multiply_wnaf_5(scalar, &precomp::CURVE_GENERATOR_PRECOMP_WNAF_5)
427+
Self::public_multiply_w5(scalar, &precomp::CURVE_GENERATOR_PRECOMP_W5)
429428
}
430429

431-
fn multiply_wnaf_5(scalar: &Scalar, precomp: &JacobianMontPointTableW5) -> Self {
432-
Self::_multiply_wnaf_5::<true>(scalar, precomp)
430+
fn multiply_w5(scalar: &Scalar, precomp: &JacobianMontPointTableW5) -> Self {
431+
Self::_multiply_w5::<true>(scalar, precomp)
433432
}
434433

435-
fn public_multiply_wnaf_5(scalar: &Scalar, precomp: &JacobianMontPointTableW5) -> Self {
436-
Self::_multiply_wnaf_5::<false>(scalar, precomp)
434+
fn public_multiply_w5(scalar: &Scalar, precomp: &JacobianMontPointTableW5) -> Self {
435+
Self::_multiply_w5::<false>(scalar, precomp)
437436
}
438437

439-
fn _multiply_wnaf_5<const SECRET: bool>(
438+
fn _multiply_w5<const SECRET: bool>(
440439
scalar: &Scalar,
441440
precomp: &JacobianMontPointTableW5,
442441
) -> Self {
@@ -1101,11 +1100,11 @@ mod tests {
11011100
}
11021101

11031102
#[test]
1104-
fn base_point_precomp_wnaf_5() {
1105-
let precomp = CURVE_GENERATOR.public_precomp_wnaf_5();
1103+
fn base_point_precomp_w5() {
1104+
let precomp = CURVE_GENERATOR.public_precomp_w5();
11061105

11071106
println!(
1108-
"pub(super) static CURVE_GENERATOR_PRECOMP_WNAF_5: super::JacobianMontPointTableW5 = ["
1107+
"pub(super) static CURVE_GENERATOR_PRECOMP_W5: super::JacobianMontPointTableW5 = ["
11091108
);
11101109
let mut i = 1;
11111110
for point in precomp.chunks_exact(18) {

‎graviola/src/mid/p384/precomp.rs

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
// This file is autogenerated, run
2-
// `cargo test p384::base_point_precomp_wnaf_5`
2+
// `cargo test p384::base_point_precomp_w5`
33
// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0
44

5-
pub(super) static CURVE_GENERATOR_PRECOMP_WNAF_5: super::JacobianMontPointTableW5 = [
5+
pub(super) static CURVE_GENERATOR_PRECOMP_W5: super::JacobianMontPointTableW5 = [
66
// 1G
77
0x3dd0756649c0b528,
88
0x20e378e2a0d6ce38,

0 commit comments

Comments
 (0)