Skip to content

Commit 71226b6

Browse files
SparkiDevSparkiDev
committed
RISC-V 32 no mul SP C: implement multiplication
No multiplication instructions when M extension not included. Standard implementation of __muldi3 is not constant time. Include a constant time implementation when SP_NO_MUL_INSTRUCTION is defined Define it when compiling for RISC-V 32 and no multiplication extension. Also fix get_entry in SP C implementation to do constant time comparison.
1 parent 350706d commit 71226b6

8 files changed

Lines changed: 143 additions & 25 deletions

File tree

‎.wolfssl_known_macro_extras‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1110,6 +1110,7 @@ __must_check
11101110
__ppc64__
11111111
__ppc__
11121112
__riscv
1113+
__riscv_mul
11131114
__riscv_xlen
11141115
__s390x__
11151116
__sparc

‎wolfcrypt/src/sp_arm32.c‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -75620,7 +75620,9 @@ static void sp_256_get_entry_16_8(sp_point_256* r,
7562075620
r->y[6] = 0;
7562175621
r->y[7] = 0;
7562275622
for (i = 1; i < 16; i++) {
75623-
mask = (sp_digit)0 - (i == idx);
75623+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
75624+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
75625+
mask = gte & lte;
7562475626
r->x[0] |= mask & table[i].x[0];
7562575627
r->x[1] |= mask & table[i].x[1];
7562675628
r->x[2] |= mask & table[i].x[2];
@@ -76000,7 +76002,9 @@ static void sp_256_get_entry_256_8(sp_point_256* r,
7600076002
r->y[6] = 0;
7600176003
r->y[7] = 0;
7600276004
for (i = 1; i < 256; i++) {
76003-
mask = (sp_digit)0 - (i == idx);
76005+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
76006+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
76007+
mask = gte & lte;
7600476008
r->x[0] |= mask & table[i].x[0];
7600576009
r->x[1] |= mask & table[i].x[1];
7600676010
r->x[2] |= mask & table[i].x[2];
@@ -93643,7 +93647,9 @@ static void sp_384_get_entry_16_12(sp_point_384* r,
9364393647
r->y[10] = 0;
9364493648
r->y[11] = 0;
9364593649
for (i = 1; i < 16; i++) {
93646-
mask = (sp_digit)0 - (i == idx);
93650+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
93651+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
93652+
mask = gte & lte;
9364793653
r->x[0] |= mask & table[i].x[0];
9364893654
r->x[1] |= mask & table[i].x[1];
9364993655
r->x[2] |= mask & table[i].x[2];
@@ -94039,7 +94045,9 @@ static void sp_384_get_entry_256_12(sp_point_384* r,
9403994045
r->y[10] = 0;
9404094046
r->y[11] = 0;
9404194047
for (i = 1; i < 256; i++) {
94042-
mask = (sp_digit)0 - (i == idx);
94048+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
94049+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
94050+
mask = gte & lte;
9404394051
r->x[0] |= mask & table[i].x[0];
9404494052
r->x[1] |= mask & table[i].x[1];
9404594053
r->x[2] |= mask & table[i].x[2];
@@ -120766,7 +120774,9 @@ static void sp_521_get_entry_16_17(sp_point_521* r,
120766120774
r->y[15] = 0;
120767120775
r->y[16] = 0;
120768120776
for (i = 1; i < 16; i++) {
120769-
mask = (sp_digit)0 - (i == idx);
120777+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
120778+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
120779+
mask = gte & lte;
120770120780
r->x[0] |= mask & table[i].x[0];
120771120781
r->x[1] |= mask & table[i].x[1];
120772120782
r->x[2] |= mask & table[i].x[2];
@@ -121182,7 +121192,9 @@ static void sp_521_get_entry_256_17(sp_point_521* r,
121182121192
r->y[15] = 0;
121183121193
r->y[16] = 0;
121184121194
for (i = 1; i < 256; i++) {
121185-
mask = (sp_digit)0 - (i == idx);
121195+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
121196+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
121197+
mask = gte & lte;
121186121198
r->x[0] |= mask & table[i].x[0];
121187121199
r->x[1] |= mask & table[i].x[1];
121188121200
r->x[2] |= mask & table[i].x[2];

‎wolfcrypt/src/sp_armthumb.c‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -101072,7 +101072,9 @@ static void sp_256_get_entry_16_8(sp_point_256* r,
101072101072
r->y[6] = 0;
101073101073
r->y[7] = 0;
101074101074
for (i = 1; i < 16; i++) {
101075-
mask = (sp_digit)0 - (i == idx);
101075+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
101076+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
101077+
mask = gte & lte;
101076101078
r->x[0] |= mask & table[i].x[0];
101077101079
r->x[1] |= mask & table[i].x[1];
101078101080
r->x[2] |= mask & table[i].x[2];
@@ -101452,7 +101454,9 @@ static void sp_256_get_entry_256_8(sp_point_256* r,
101452101454
r->y[6] = 0;
101453101455
r->y[7] = 0;
101454101456
for (i = 1; i < 256; i++) {
101455-
mask = (sp_digit)0 - (i == idx);
101457+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
101458+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
101459+
mask = gte & lte;
101456101460
r->x[0] |= mask & table[i].x[0];
101457101461
r->x[1] |= mask & table[i].x[1];
101458101462
r->x[2] |= mask & table[i].x[2];
@@ -111495,7 +111499,9 @@ static void sp_384_get_entry_16_12(sp_point_384* r,
111495111499
r->y[10] = 0;
111496111500
r->y[11] = 0;
111497111501
for (i = 1; i < 16; i++) {
111498-
mask = (sp_digit)0 - (i == idx);
111502+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
111503+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
111504+
mask = gte & lte;
111499111505
r->x[0] |= mask & table[i].x[0];
111500111506
r->x[1] |= mask & table[i].x[1];
111501111507
r->x[2] |= mask & table[i].x[2];
@@ -111891,7 +111897,9 @@ static void sp_384_get_entry_256_12(sp_point_384* r,
111891111897
r->y[10] = 0;
111892111898
r->y[11] = 0;
111893111899
for (i = 1; i < 256; i++) {
111894-
mask = (sp_digit)0 - (i == idx);
111900+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
111901+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
111902+
mask = gte & lte;
111895111903
r->x[0] |= mask & table[i].x[0];
111896111904
r->x[1] |= mask & table[i].x[1];
111897111905
r->x[2] |= mask & table[i].x[2];
@@ -124705,7 +124713,9 @@ static void sp_521_get_entry_16_17(sp_point_521* r,
124705124713
r->y[15] = 0;
124706124714
r->y[16] = 0;
124707124715
for (i = 1; i < 16; i++) {
124708-
mask = (sp_digit)0 - (i == idx);
124716+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
124717+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
124718+
mask = gte & lte;
124709124719
r->x[0] |= mask & table[i].x[0];
124710124720
r->x[1] |= mask & table[i].x[1];
124711124721
r->x[2] |= mask & table[i].x[2];
@@ -125121,7 +125131,9 @@ static void sp_521_get_entry_256_17(sp_point_521* r,
125121125131
r->y[15] = 0;
125122125132
r->y[16] = 0;
125123125133
for (i = 1; i < 256; i++) {
125124-
mask = (sp_digit)0 - (i == idx);
125134+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
125135+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
125136+
mask = gte & lte;
125125125137
r->x[0] |= mask & table[i].x[0];
125126125138
r->x[1] |= mask & table[i].x[1];
125127125139
r->x[2] |= mask & table[i].x[2];

‎wolfcrypt/src/sp_c32.c‎

Lines changed: 74 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,71 @@
114114

115115
#ifndef WOLFSSL_SP_ASM
116116
#if SP_WORD_SIZE == 32
117+
#ifdef SP_NO_MUL_INSTRUCTION
118+
sp_uint64 __muldi3(sp_uint64 a, sp_uint64 b);
119+
sp_uint64 __muldi3(sp_uint64 a, sp_uint64 b)
120+
{
121+
sp_uint64 r;
122+
sp_uint64 am[16];
123+
124+
/* if b is negative, convert it to positive and negate a. */
125+
r = 0 - (b >> 63);
126+
a = a ^ r;
127+
b = b ^ r;
128+
a -= r;
129+
b -= r;
130+
131+
#if defined(WOLFSSL_SP_SMALL)
132+
int i;
133+
134+
am[0] = 0;
135+
for (i = 1; i < 16; i++) {
136+
am[i] = am[i-1] + a;
137+
}
138+
139+
r = am[(b >> 28) & 0xf];
140+
for (i = 24; i >= 0; i -= 4) {
141+
r <<= 4;
142+
r += am[(b >> i) & 0xf];
143+
}
144+
#else
145+
am[ 0] = 0;
146+
am[ 1] = a;
147+
am[ 2] = a << 1;
148+
am[ 3] = am[ 2] + a;
149+
am[ 4] = a << 2;
150+
am[ 5] = am[ 4] + a;
151+
am[ 6] = am[ 5] + a;
152+
am[ 7] = am[ 6] + a;
153+
am[ 8] = a << 3;
154+
am[ 9] = am[ 8] + a;
155+
am[10] = am[ 9] + a;
156+
am[11] = am[10] + a;
157+
am[12] = am[11] + a;
158+
am[13] = am[12] + a;
159+
am[14] = am[13] + a;
160+
am[15] = am[14] + a;
161+
162+
r = am[(b >> 28) & 0xf];
163+
r <<= 4;
164+
r += am[(b >> 24) & 0xf];
165+
r <<= 4;
166+
r += am[(b >> 20) & 0xf];
167+
r <<= 4;
168+
r += am[(b >> 16) & 0xf];
169+
r <<= 4;
170+
r += am[(b >> 12) & 0xf];
171+
r <<= 4;
172+
r += am[(b >> 8) & 0xf];
173+
r <<= 4;
174+
r += am[(b >> 4) & 0xf];
175+
r <<= 4;
176+
r += am[(b >> 0) & 0xf];
177+
#endif
178+
179+
return r;
180+
}
181+
#endif /* SP_NO_MUL_INSTRUCTION */
117182
#define SP_PRINT_NUM(var, name, total, words, bits) \
118183
do { \
119184
int ii; \
@@ -21252,7 +21317,9 @@ static void sp_256_get_entry_256_9(sp_point_256* r,
2125221317
r->y[7] = 0;
2125321318
r->y[8] = 0;
2125421319
for (i = 1; i < 256; i++) {
21255-
mask = (sp_digit)0 - (i == idx);
21320+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
21321+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
21322+
mask = gte & lte;
2125621323
r->x[0] |= mask & table[i].x[0];
2125721324
r->x[1] |= mask & table[i].x[1];
2125821325
r->x[2] |= mask & table[i].x[2];
@@ -28357,7 +28424,9 @@ static void sp_384_get_entry_256_15(sp_point_384* r,
2835728424
r->y[13] = 0;
2835828425
r->y[14] = 0;
2835928426
for (i = 1; i < 256; i++) {
28360-
mask = (sp_digit)0 - (i == idx);
28427+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
28428+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
28429+
mask = gte & lte;
2836128430
r->x[0] |= mask & table[i].x[0];
2836228431
r->x[1] |= mask & table[i].x[1];
2836328432
r->x[2] |= mask & table[i].x[2];
@@ -35524,7 +35593,9 @@ static void sp_521_get_entry_256_21(sp_point_521* r,
3552435593
r->y[19] = 0;
3552535594
r->y[20] = 0;
3552635595
for (i = 1; i < 256; i++) {
35527-
mask = (sp_digit)0 - (i == idx);
35596+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
35597+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
35598+
mask = gte & lte;
3552835599
r->x[0] |= mask & table[i].x[0];
3552935600
r->x[1] |= mask & table[i].x[1];
3553035601
r->x[2] |= mask & table[i].x[2];

‎wolfcrypt/src/sp_c64.c‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21818,7 +21818,9 @@ static void sp_256_get_entry_256_5(sp_point_256* r,
2181821818
r->y[3] = 0;
2181921819
r->y[4] = 0;
2182021820
for (i = 1; i < 256; i++) {
21821-
mask = (sp_digit)0 - (i == idx);
21821+
sp_digit gte = (sp_digit)((((sp_uint64)i - (sp_uint64)idx) >> 63) - 1);
21822+
sp_digit lte = (sp_digit)((((sp_uint64)idx - (sp_uint64)i) >> 63) - 1);
21823+
mask = gte & lte;
2182221824
r->x[0] |= mask & table[i].x[0];
2182321825
r->x[1] |= mask & table[i].x[1];
2182421826
r->x[2] |= mask & table[i].x[2];
@@ -28358,7 +28360,9 @@ static void sp_384_get_entry_256_7(sp_point_384* r,
2835828360
r->y[5] = 0;
2835928361
r->y[6] = 0;
2836028362
for (i = 1; i < 256; i++) {
28361-
mask = (sp_digit)0 - (i == idx);
28363+
sp_digit gte = (sp_digit)((((sp_uint64)i - (sp_uint64)idx) >> 63) - 1);
28364+
sp_digit lte = (sp_digit)((((sp_uint64)idx - (sp_uint64)i) >> 63) - 1);
28365+
mask = gte & lte;
2836228366
r->x[0] |= mask & table[i].x[0];
2836328367
r->x[1] |= mask & table[i].x[1];
2836428368
r->x[2] |= mask & table[i].x[2];
@@ -35371,7 +35375,9 @@ static void sp_521_get_entry_256_9(sp_point_521* r,
3537135375
r->y[7] = 0;
3537235376
r->y[8] = 0;
3537335377
for (i = 1; i < 256; i++) {
35374-
mask = (sp_digit)0 - (i == idx);
35378+
sp_digit gte = (sp_digit)((((sp_uint64)i - (sp_uint64)idx) >> 63) - 1);
35379+
sp_digit lte = (sp_digit)((((sp_uint64)idx - (sp_uint64)i) >> 63) - 1);
35380+
mask = gte & lte;
3537535381
r->x[0] |= mask & table[i].x[0];
3537635382
r->x[1] |= mask & table[i].x[1];
3537735383
r->x[2] |= mask & table[i].x[2];

‎wolfcrypt/src/sp_cortexm.c‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -37006,7 +37006,9 @@ static void sp_256_get_entry_16_8(sp_point_256* r,
3700637006
r->y[6] = 0;
3700737007
r->y[7] = 0;
3700837008
for (i = 1; i < 16; i++) {
37009-
mask = (sp_digit)0 - (i == idx);
37009+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
37010+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
37011+
mask = gte & lte;
3701037012
r->x[0] |= mask & table[i].x[0];
3701137013
r->x[1] |= mask & table[i].x[1];
3701237014
r->x[2] |= mask & table[i].x[2];
@@ -37386,7 +37388,9 @@ static void sp_256_get_entry_256_8(sp_point_256* r,
3738637388
r->y[6] = 0;
3738737389
r->y[7] = 0;
3738837390
for (i = 1; i < 256; i++) {
37389-
mask = (sp_digit)0 - (i == idx);
37391+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
37392+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
37393+
mask = gte & lte;
3739037394
r->x[0] |= mask & table[i].x[0];
3739137395
r->x[1] |= mask & table[i].x[1];
3739237396
r->x[2] |= mask & table[i].x[2];
@@ -46949,7 +46953,9 @@ static void sp_384_get_entry_16_12(sp_point_384* r,
4694946953
r->y[10] = 0;
4695046954
r->y[11] = 0;
4695146955
for (i = 1; i < 16; i++) {
46952-
mask = (sp_digit)0 - (i == idx);
46956+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
46957+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
46958+
mask = gte & lte;
4695346959
r->x[0] |= mask & table[i].x[0];
4695446960
r->x[1] |= mask & table[i].x[1];
4695546961
r->x[2] |= mask & table[i].x[2];
@@ -47345,7 +47351,9 @@ static void sp_384_get_entry_256_12(sp_point_384* r,
4734547351
r->y[10] = 0;
4734647352
r->y[11] = 0;
4734747353
for (i = 1; i < 256; i++) {
47348-
mask = (sp_digit)0 - (i == idx);
47354+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
47355+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
47356+
mask = gte & lte;
4734947357
r->x[0] |= mask & table[i].x[0];
4735047358
r->x[1] |= mask & table[i].x[1];
4735147359
r->x[2] |= mask & table[i].x[2];
@@ -58780,7 +58788,9 @@ static void sp_521_get_entry_16_17(sp_point_521* r,
5878058788
r->y[15] = 0;
5878158789
r->y[16] = 0;
5878258790
for (i = 1; i < 16; i++) {
58783-
mask = (sp_digit)0 - (i == idx);
58791+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
58792+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
58793+
mask = gte & lte;
5878458794
r->x[0] |= mask & table[i].x[0];
5878558795
r->x[1] |= mask & table[i].x[1];
5878658796
r->x[2] |= mask & table[i].x[2];
@@ -59196,7 +59206,9 @@ static void sp_521_get_entry_256_17(sp_point_521* r,
5919659206
r->y[15] = 0;
5919759207
r->y[16] = 0;
5919859208
for (i = 1; i < 256; i++) {
59199-
mask = (sp_digit)0 - (i == idx);
59209+
sp_digit gte = (sp_digit)((((sp_uint32)i - (sp_uint32)idx) >> 31) - 1);
59210+
sp_digit lte = (sp_digit)((((sp_uint32)idx - (sp_uint32)i) >> 31) - 1);
59211+
mask = gte & lte;
5920059212
r->x[0] |= mask & table[i].x[0];
5920159213
r->x[1] |= mask & table[i].x[1];
5920259214
r->x[2] |= mask & table[i].x[2];

‎wolfcrypt/src/sp_x86_64_asm.asm‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
; /* sp_x86_64_asm.asm */
22
; /*
3-
; * Copyright (C) 2006-2026 wolfSSL Inc.
3+
; * Copyright (C) 2006-2026 wolfSSL Inc.
44
; *
55
; * This file is part of wolfSSL.
66
; *

‎wolfssl/wolfcrypt/sp.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@
2626
#include <wolfssl/wolfcrypt/types.h>
2727
#include <wolfssl/wolfcrypt/settings.h>
2828

29+
#if defined(__riscv) && (__riscv_xlen == 32) && !defined(__riscv_mul)
30+
#define SP_NO_MUL_INSTRUCTION
31+
#endif
32+
2933
#if defined(WOLFSSL_HAVE_SP_RSA) || defined(WOLFSSL_HAVE_SP_DH) || \
3034
defined(WOLFSSL_HAVE_SP_ECC)
3135
#ifdef _WIN32_WCE

0 commit comments

Comments
 (0)