lib/libcrypto/constant_time_locl.h

   1 /* crypto/constant_time_locl.h */
   2 /*-
   3  * Utilities for constant-time cryptography.
   4  *
   5  * Author: Emilia Kasper (emilia@openssl.org)
   6  * Based on previous work by Bodo Moeller, Emilia Kasper, Adam Langley
   7  * (Google).
   8  * ====================================================================
   9  * Copyright (c) 2014 The OpenSSL Project.  All rights reserved.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  * 1. Redistributions of source code must retain the copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  * 3. All advertising materials mentioning features or use of this software
  20  *    must display the following acknowledgement:
  21  *    "This product includes cryptographic software written by
  22  *     Eric Young (eay@cryptsoft.com)"
  23  *    The word 'cryptographic' can be left out if the rouines from the library
  24  *    being used are not cryptographic related :-).
  25  * 4. If you include any Windows specific code (or a derivative thereof) from
  26  *    the apps directory (application code) you must include an acknowledgement:
  27  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  28  *
  29  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  30  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  31  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  32  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  33  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  34  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  35  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  36  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  37  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  38  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  39  * SUCH DAMAGE.
  40  *
  41  * The licence and distribution terms for any publically available version or
  42  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  43  * copied and put under another distribution licence
  44  * [including the GNU Public Licence.]
  45  */
  46
  47 #ifndef HEADER_CONSTANT_TIME_LOCL_H
  48 # define HEADER_CONSTANT_TIME_LOCL_H
  49
  50 __BEGIN_HIDDEN_DECLS
  51
  52 /*-
  53  * The boolean methods return a bitmask of all ones (0xff...f) for true
  54  * and 0 for false. This is useful for choosing a value based on the result
  55  * of a conditional in constant time. For example,
  56  *
  57  * if (a < b) {
  58  *   c = a;
  59  * } else {
  60  *   c = b;
  61  * }
  62  *
  63  * can be written as
  64  *
  65  * unsigned int lt = constant_time_lt(a, b);
  66  * c = constant_time_select(lt, a, b);
  67  */
  68
  69 /*
  70  * Returns the given value with the MSB copied to all the other
  71  * bits. Uses the fact that arithmetic shift shifts-in the sign bit.
  72  * However, this is not ensured by the C standard so you may need to
  73  * replace this with something else on odd CPUs.
  74  */
  75 static inline unsigned int constant_time_msb(unsigned int a);
  76
  77 /*
  78  * Returns 0xff..f if a < b and 0 otherwise.
  79  */
  80 static inline unsigned int constant_time_lt(unsigned int a, unsigned int b);
  81 /* Convenience method for getting an 8-bit mask. */
  82 static inline unsigned char constant_time_lt_8(unsigned int a,
  83                                                unsigned int b);
  84
  85 /*
  86  * Returns 0xff..f if a >= b and 0 otherwise.
  87  */
  88 static inline unsigned int constant_time_ge(unsigned int a, unsigned int b);
  89 /* Convenience method for getting an 8-bit mask. */
  90 static inline unsigned char constant_time_ge_8(unsigned int a,
  91                                                unsigned int b);
  92
  93 /*
  94  * Returns 0xff..f if a == 0 and 0 otherwise.
  95  */
  96 static inline unsigned int constant_time_is_zero(unsigned int a);
  97 /* Convenience method for getting an 8-bit mask. */
  98 static inline unsigned char constant_time_is_zero_8(unsigned int a);
  99
 100 /*
 101  * Returns 0xff..f if a == b and 0 otherwise.
 102  */
 103 static inline unsigned int constant_time_eq(unsigned int a, unsigned int b);
 104 /* Convenience method for getting an 8-bit mask. */
 105 static inline unsigned char constant_time_eq_8(unsigned int a,
 106                                                unsigned int b);
 107 /* Signed integers. */
 108 static inline unsigned int constant_time_eq_int(int a, int b);
 109 /* Convenience method for getting an 8-bit mask. */
 110 static inline unsigned char constant_time_eq_int_8(int a, int b);
 111
 112 /*-
 113  * Returns (mask & a) | (~mask & b).
 114  *
 115  * When |mask| is all 1s or all 0s (as returned by the methods above),
 116  * the select methods return either |a| (if |mask| is nonzero) or |b|
 117  * (if |mask| is zero).
 118  */
 119 static inline unsigned int constant_time_select(unsigned int mask,
 120                                                 unsigned int a,
 121                                                 unsigned int b);
 122 /* Convenience method for unsigned chars. */
 123 static inline unsigned char constant_time_select_8(unsigned char mask,
 124                                                    unsigned char a,
 125                                                    unsigned char b);
 126 /* Convenience method for signed integers. */
 127 static inline int constant_time_select_int(unsigned int mask, int a, int b);
 128
 129 static inline unsigned int constant_time_msb(unsigned int a)
 130 {
 131     return 0 - (a >> (sizeof(a) * 8 - 1));
 132 }
 133
 134 static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
 135 {
 136     return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));
 137 }
 138
 139 static inline unsigned char constant_time_lt_8(unsigned int a, unsigned int b)
 140 {
 141     return (unsigned char)(constant_time_lt(a, b));
 142 }
 143
 144 static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)
 145 {
 146     return ~constant_time_lt(a, b);
 147 }
 148
 149 static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b)
 150 {
 151     return (unsigned char)(constant_time_ge(a, b));
 152 }
 153
 154 static inline unsigned int constant_time_is_zero(unsigned int a)
 155 {
 156     return constant_time_msb(~a & (a - 1));
 157 }
 158
 159 static inline unsigned char constant_time_is_zero_8(unsigned int a)
 160 {
 161     return (unsigned char)(constant_time_is_zero(a));
 162 }
 163
 164 static inline unsigned int constant_time_eq(unsigned int a, unsigned int b)
 165 {
 166     return constant_time_is_zero(a ^ b);
 167 }
 168
 169 static inline unsigned char constant_time_eq_8(unsigned int a, unsigned int b)
 170 {
 171     return (unsigned char)(constant_time_eq(a, b));
 172 }
 173
 174 static inline unsigned int constant_time_eq_int(int a, int b)
 175 {
 176     return constant_time_eq((unsigned)(a), (unsigned)(b));
 177 }
 178
 179 static inline unsigned char constant_time_eq_int_8(int a, int b)
 180 {
 181     return constant_time_eq_8((unsigned)(a), (unsigned)(b));
 182 }
 183
 184 static inline unsigned int constant_time_select(unsigned int mask,
 185                                                 unsigned int a,
 186                                                 unsigned int b)
 187 {
 188     return (mask & a) | (~mask & b);
 189 }
 190
 191 static inline unsigned char constant_time_select_8(unsigned char mask,
 192                                                    unsigned char a,
 193                                                    unsigned char b)
 194 {
 195     return (unsigned char)(constant_time_select(mask, a, b));
 196 }
 197
 198 static inline int constant_time_select_int(unsigned int mask, int a, int b)
 199 {
 200     return (int)(constant_time_select(mask, (unsigned)(a), (unsigned)(b)));
 201 }
 202
 203 __END_HIDDEN_DECLS
 204
 205 #endif                          /* HEADER_CONSTANT_TIME_LOCL_H */