Received-SPF: pass (google.com: domain of linux-crypto+bounces-2702-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
From: Bharat Bhushan <bbhushan2@marvell.com>
To: Stefan Berger <stefanb@linux.vnet.ibm.com>,
        "keyrings@vger.kernel.org"
	<keyrings@vger.kernel.org>,
        "linux-crypto@vger.kernel.org"
	<linux-crypto@vger.kernel.org>,
        "herbert@gondor.apana.org.au"
	<herbert@gondor.apana.org.au>,
        "davem@davemloft.net" <davem@davemloft.net>
CC: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "saulo.alessandre@tse.jus.br" <saulo.alessandre@tse.jus.br>,
        "lukas@wunner.de" <lukas@wunner.de>,
        "jarkko@kernel.org" <jarkko@kernel.org>,
        Stefan Berger <stefanb@linux.ibm.com>
Subject: RE: [EXTERNAL] [PATCH v6 06/13] crypto: ecc - Implement
 vli_mmod_fast_521 for NIST p521
Thread-Topic: [EXTERNAL] [PATCH v6 06/13] crypto: ecc - Implement
 vli_mmod_fast_521 for NIST p521
Thread-Index: AQHadKxnItlGMkulP0OOPNqggLqEwLE9BMsA
Date: Mon, 18 Mar 2024 05:47:54 +0000
Message-ID: 
 <SN7PR18MB5314CB6B4CF9678BDDF0D012E32D2@SN7PR18MB5314.namprd18.prod.outlook.com>
References: <20240312183618.1211745-1-stefanb@linux.vnet.ibm.com>
 <20240312183618.1211745-7-stefanb@linux.vnet.ibm.com>
In-Reply-To: <20240312183618.1211745-7-stefanb@linux.vnet.ibm.com>
Accept-Language: en-IN, en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 
 =?us-ascii?Q?Ocq4HdmnO3AWJUWVLhiMT1NpxfVDiAkd2mDpU+H9Yt41RfAQZZMuiUf/BrhO?=
 =?us-ascii?Q?fA4gH7ZTiJQMavl3OFjXcro7ZCy7nVEc0kxL7AHoUzjfGDrNjkUVu0iVbQAY?=
 =?us-ascii?Q?5+L/OQcthF0TlL55f3RqKm/evHR/R5UiFlaaKLGVgkO4P79D0nm0c2czngMS?=
 =?us-ascii?Q?1Q0HzI7Xv/T7xmJkYeJEpGyW7n4tY3wUDEcrAvAdl0DZYHTfk2J4afQcHIkf?=
 =?us-ascii?Q?Ztic3zxa+dT9LD5NU4x++xeiW8bw2cl6qqtG0dnqSBCij+sdw7WFreXjkOlr?=
 =?us-ascii?Q?zsmIckDseXMCo3+e9YwWDZpE0nxMg29ryZ8Y1dhXWfZ8UL16wNb7ouaC5jiw?=
 =?us-ascii?Q?U8jHt923TZwP4poZCfP4QxdAdRSCLlPAyreW6AiOXAgO8KMi1xcJn9Dog7hp?=
 =?us-ascii?Q?DkQPLsgTjFnc9Gn+2P6SMheCrniNawwi+l7QMnUgyG7mR6tKCg4jfQ3VoVot?=
 =?us-ascii?Q?opvTHqXIT4g6VRBB+6Hrk971RVO/6VLTI+O3BddoMNRdkX5BUOAdUjmKbIZt?=
 =?us-ascii?Q?g9x2w2c0oHF4oZFpfm0ckSveHufevSvPdF1KA6DXWFA39HohsZd8/7ZQJEF8?=
 =?us-ascii?Q?UQlHGzpKQjZyPhIdGeXlVlB2MzgKKqLPb793wEJbhbALolGjclKtJMYgyWwz?=
 =?us-ascii?Q?Do2sI1Jve4PPaxs/SZjM5nhflMzje+MAyGqCbLeM/Zwjzn73KE/BjZuC3D2C?=
 =?us-ascii?Q?vFLonOjnf/cFnCwrfc32YoQUuXMWTlHqhp5snNvN2Esc15NzVd685MQPm4dl?=
 =?us-ascii?Q?G2wOMIucBVtlCYrWA2i+l3oX2qdabMH4ou1HSsmZq3iN5HUfYuewdEPvoWwg?=
 =?us-ascii?Q?U/o48jXYJYli6Ju1s3U0+7+PGEoADjl7wphCEgZ7+XkMgV21kRiRq4h8/rqF?=
 =?us-ascii?Q?67xvdtNEJc6+6OUBIKW7t3qALcGd3WHUxs9ULGSQ2tD5up30NLH5puT/D225?=
 =?us-ascii?Q?ZZfOf0EIAmwe/6LVSlT4NMtH02B/yo7kaBS3BF4BNovLGSwsQbBHjOhh9UGo?=
 =?us-ascii?Q?9YPbr2QDxwTlYrsnp3YlpoaMmR58xu65h7Sub4GLaw8V1vNhX16jzxt4hOg/?=
 =?us-ascii?Q?t3vrxIllQtFTYqS5ksm5mL2yzx1OctJeiSHf3GZW44j2xZd8cZzHOezWznzE?=
 =?us-ascii?Q?6H4wkp0Qjjkrb6I+KhYTFto4QjRnPrmUic7hquMbdTb3qx5uMuC4t6GRoxqb?=
 =?us-ascii?Q?rUbqVXvVNHfB0emBtc0Z6nPmIzAnhbSsTl15ihO7cGiGj1btvIfE39Aw2clT?=
 =?us-ascii?Q?OocPmiMFqjyCPONfkQtOug93mRph6+u/JyNzFNJErZKptvwxjiQNYo6lqjIR?=
 =?us-ascii?Q?vQm9U+/gJFnaS1Dzwy3n0oNrIG9D7zY/8U15D2fICNeToJv+Q+1uYuxeO9E+?=
 =?us-ascii?Q?8DjGCdkt0MNTMySlhQJdk1pkd+Ry8UJvSBSiXCM9XIcjHpvilfHwjwMX1FW+?=
 =?us-ascii?Q?38kkX0tnM2N36SkBgw47im9jwIZ9hgEzPK2LNr95I9imOHwV6alCcpZUhAkT?=
 =?us-ascii?Q?Bh7t8eqmRrRs219D1an1VmE7dHyRflRoPNhycSa7u8ItyQQcjK5U5rx4lqak?=
 =?us-ascii?Q?DjyzGofF3qfRJ7CZKfOqQUUSDEkL8YPRyFd+bruQ?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-crypto@vger.kernel.org
List-Id: <linux-crypto.vger.kernel.org>
List-Subscribe: <mailto:linux-crypto+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-crypto+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-OriginatorOrg: marvell.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN7PR18MB5314.namprd18.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b295589e-0e27-4967-b328-08dc470ef534
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Mar 2024 05:47:54.8140
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 70e1fb47-1155-421d-87fc-2e58f638b6e0
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 80y3OfRrBIlFWkEgzZWIBOW1eemHf3Oxbx8KY3VyJTKBS3ziFIVKUYV+nKqqbcwOA+8LaZqjy2garPgsp7e+TQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR18MB5600
X-Proofpoint-ORIG-GUID: pMzwvcDGoADjVqXYFcGcP-Mm7mwtU8UV
X-Proofpoint-GUID: pMzwvcDGoADjVqXYFcGcP-Mm7mwtU8UV
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2024-03-17_12,2024-03-15_01,2023-05-22_02


> -----Original Message-----
> From: Stefan Berger <stefanb@linux.vnet.ibm.com>
> Sent: Wednesday, March 13, 2024 12:06 AM
> To: keyrings@vger.kernel.org; linux-crypto@vger.kernel.org;
> herbert@gondor.apana.org.au; davem@davemloft.net
> Cc: linux-kernel@vger.kernel.org; saulo.alessandre@tse.jus.br;
> lukas@wunner.de; Bharat Bhushan <bbhushan2@marvell.com>;
> jarkko@kernel.org; Stefan Berger <stefanb@linux.ibm.com>
> Subject: [EXTERNAL] [PATCH v6 06/13] crypto: ecc - Implement
> vli_mmod_fast_521 for NIST p521
>=20
> Prioritize security for external emails: Confirm sender and content safet=
y
> before clicking links or opening attachments
>=20
> ----------------------------------------------------------------------
> From: Stefan Berger <stefanb@linux.ibm.com>
>=20
> Implement vli_mmod_fast_521 following the description for how to calculat=
e
> the modulus for NIST P521 in the NIST publication "Recommendations for
> Discrete Logarithm-Based Cryptography: Elliptic Curve Domain Parameters"
> section G.1.4.
>=20
> NIST p521 requires 9 64bit digits, so increase the ECC_MAX_DIGITS so that
> arrays fit the larger numbers.
>=20
> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> ---
>  crypto/ecc.c                  | 25 +++++++++++++++++++++++++
>  include/crypto/internal/ecc.h |  3 ++-
>  2 files changed, 27 insertions(+), 1 deletion(-)
>=20
> diff --git a/crypto/ecc.c b/crypto/ecc.c index 415a2f4e7291..99d41887c005
> 100644
> --- a/crypto/ecc.c
> +++ b/crypto/ecc.c
> @@ -902,6 +902,28 @@ static void vli_mmod_fast_384(u64 *result, const
> u64 *product,  #undef AND64H  #undef AND64L
>=20
> +/*
> + * Computes result =3D product % curve_prime
> + * from "Recommendations for Discrete Logarithm-Based Cryptography:
> + *       Elliptic Curve Domain Parameters" section G.1.4
> + */
> +static void vli_mmod_fast_521(u64 *result, const u64 *product,
> +			      const u64 *curve_prime, u64 *tmp) {
> +	const unsigned int ndigits =3D ECC_CURVE_NIST_P521_DIGITS;
> +	size_t i;
> +
> +	/* Initialize result with lowest 521 bits from product */
> +	vli_set(result, product, ndigits);
> +	result[8] &=3D 0x1ff;
> +
> +	for (i =3D 0; i < ndigits; i++)
> +		tmp[i] =3D (product[8 + i] >> 9) | (product[9 + i] << 55);
> +	tmp[8] &=3D 0x1ff;

Can we get away from this hardcoding, like 9, 55, 0x1ff etc.
Or at least add comment about these.

> +
> +	vli_mod_add(result, result, tmp, curve_prime, ndigits); }
> +
>  /* Computes result =3D product % curve_prime for different curve_primes.
>   *
>   * Note that curve_primes are distinguished just by heuristic check and =
@@ -
> 941,6 +963,9 @@ static bool vli_mmod_fast(u64 *result, u64 *product,
>  	case ECC_CURVE_NIST_P384_DIGITS:
>  		vli_mmod_fast_384(result, product, curve_prime, tmp);
>  		break;
> +	case ECC_CURVE_NIST_P521_DIGITS:
> +		vli_mmod_fast_521(result, product, curve_prime, tmp);
> +		break;
>  	default:
>  		pr_err_ratelimited("ecc: unsupported digits size!\n");
>  		return false;
> diff --git a/include/crypto/internal/ecc.h b/include/crypto/internal/ecc.=
h index
> ab722a8986b7..4e2f5f938e91 100644
> --- a/include/crypto/internal/ecc.h
> +++ b/include/crypto/internal/ecc.h
> @@ -33,7 +33,8 @@
>  #define ECC_CURVE_NIST_P192_DIGITS  3
>  #define ECC_CURVE_NIST_P256_DIGITS  4
>  #define ECC_CURVE_NIST_P384_DIGITS  6
> -#define ECC_MAX_DIGITS              (512 / 64) /* due to ecrdsa */
> +#define ECC_CURVE_NIST_P521_DIGITS  9

Maybe these can be defined as:
#define ECC_CURVE_NIST_P521_DIGITS  (DIV_ROUND_UP(521, 64) /* NIST P521 */)

> +#define ECC_MAX_DIGITS              DIV_ROUND_UP(521, 64) /* NIST P521 *=
/

/* NIST_P521 is max digits */
#define ECC_MAX_DIGITS              ECC_CURVE_ _DIGITS

Thanks
-Bharat

>=20
>  #define ECC_DIGITS_TO_BYTES_SHIFT 3
>=20
> --
> 2.43.0