> -----Original Message-----
> From: Stefan Berger <[email protected]>
> Sent: Monday, March 11, 2024 7:33 PM
> To: Bharat Bhushan <[email protected]>; [email protected]; linux-
> [email protected]; [email protected]; [email protected]
> Cc: [email protected]; [email protected]; [email protected]
> Subject: [EXTERNAL] Re: [PATCH v5 05/12] crypto: ecc - Implement
> vli_mmod_fast_521 for NIST p521
> >
> ----------------------------------------------------------------------
>
>
> On 3/11/24 01:07, Bharat Bhushan wrote:
> > Minor nits
> >
> >> -----Original Message-----
> >> From: Stefan Berger <[email protected]>
> >> Sent: Thursday, March 7, 2024 3:53 AM
> >> To: [email protected]; [email protected];
> >> [email protected]; [email protected]
> >> Cc: [email protected]; [email protected];
> >> [email protected]; Stefan Berger <[email protected]>
> >> Subject: [EXTERNAL] [PATCH v5 05/12] crypto: ecc - Implement
> >> vli_mmod_fast_521 for NIST p521
> >>
> >> ---------------------------------------------------------------------
> >> - Implement vli_mmod_fast_521 following the description for how to
> >> calculate the modulus for NIST P521 in the NIST publication
> >> "Recommendations for Discrete Logarithm-Based Cryptography: Elliptic
> >> Curve Domain Parameters"
> >> section G.1.4.
> >>
> >> NIST p521 requires 9 64bit digits, so increase the ECC_MAX_DIGITS so
> >> that arrays fit the larger numbers.
> >>
> >> Signed-off-by: Stefan Berger <[email protected]>
> >> Tested-by: Lukas Wunner <[email protected]>
> >> ---
> >> crypto/ecc.c | 31 +++++++++++++++++++++++++++++++
> >> include/crypto/internal/ecc.h | 2 +-
> >> 2 files changed, 32 insertions(+), 1 deletion(-)
> >>
> >> diff --git a/crypto/ecc.c b/crypto/ecc.c index
> >> f53fb4d6af99..373660e7b19d
> >> 100644
> >> --- a/crypto/ecc.c
> >> +++ b/crypto/ecc.c
> >> @@ -902,6 +902,31 @@ static void vli_mmod_fast_384(u64 *result, const
> >> u64 *product, #undef AND64H #undef AND64L
> >>
> >> +/* Computes result = product % curve_prime
> >> + * from "Recommendations for Discrete Logarithm-Based Cryptography:
> >> + * Elliptic Curve Domain Parameters" G.1.4
> >> + */
> >> +static void vli_mmod_fast_521(u64 *result, const u64 *product,
> >> + const u64 *curve_prime, u64 *tmp) {
> >> + const unsigned int ndigits = 9;
> >> + size_t i;
> >> +
> >> + for (i = 0; i < ndigits; i++)
> >> + tmp[i] = product[i];
> >> + tmp[8] &= 0x1ff;
> >> +
> >> + vli_set(result, tmp, ndigits);
>
> I have also modified this here now to initialize 'result' from lowest
> 521 bis of product without the detour through tmp.
>
> >> +
> >> +
> >> + for (i = 0; i < ndigits; i++)
> >> + tmp[i] = (product[8 + i] >> 9) | (product[9 + i] << 55);
> >> + tmp[8] &= 0x1ff;
> >> +
> >> + vli_mod_add(result, result, tmp, curve_prime, ndigits); }
> >> +
> >> +
> >> /* Computes result = product % curve_prime for different curve_primes.
> >> *
> >> * Note that curve_primes are distinguished just by heuristic check
> >> and @@ -
> >> 941,6 +966,12 @@ static bool vli_mmod_fast(u64 *result, u64 *product,
> >> case 6:
> >> vli_mmod_fast_384(result, product, curve_prime, tmp);
> >> break;
> >> + case 9:
> >
> > Can we use ECC_CURVE_NIST_P384_DIGITS, ECC_CURVE_NIST_P256_DIGITS
> in this function?
> >
> > And define ECC_CURVE_NIST_P521_DIGITS, which is same as
> ECC_MAX_DIGITS defined below in this patch?
> >
> >> + if (curve->nbits == 521) {
>
> If I replace the numbers with these hash-defines's in here (in an additional patch
> on existing code) then I can just about remove the check on nbits here as well... ?
Yes, can use same define here.
Thanks
-Bharat
>
>
> >> + vli_mmod_fast_521(result, product, curve_prime,
> >> tmp);
> >> + break;
> >> + }
> >> + fallthrough;
> >> default:
> >> pr_err_ratelimited("ecc: unsupported digits size!\n");
> >> return false;
> >> diff --git a/include/crypto/internal/ecc.h
> >> b/include/crypto/internal/ecc.h index 4a556b41873e..de17bcdeb53a
> >> 100644
> >> --- a/include/crypto/internal/ecc.h
> >> +++ b/include/crypto/internal/ecc.h
> >> @@ -33,7 +33,7 @@
> >> #define ECC_CURVE_NIST_P192_DIGITS 3
> >> #define ECC_CURVE_NIST_P256_DIGITS 4
> >> #define ECC_CURVE_NIST_P384_DIGITS 6
> >> -#define ECC_MAX_DIGITS (512 / 64) /* due to ecrdsa */
> >> +#define ECC_MAX_DIGITS DIV_ROUND_UP(521, 64) /* NIST P521 */
> >>
> >> #define ECC_DIGITS_TO_BYTES_SHIFT 3
> >>
> >> --
> >> 2.43.0
> >>
> >