OpenCoverage

f_generic.c

Absolute File Name:

/home/opencoverage/opencoverage/guest-scripts/openssl/src/crypto/ec/curve448/f_generic.c

Source code

Switch to Preprocessed file

Line Source Count

1 /* -

4 * -

5 * Licensed under the OpenSSL license (the "License"). You may not use -

6 * this file except in compliance with the License. You can obtain a copy -

7 * in the file LICENSE in the source distribution or at -

8 * https://www.openssl.org/source/license.html -

9 * -

10 * Originally written by Mike Hamburg -

11 */ -

12 #include "field.h" -

13 -

14 static const gf MODULUS = { -

15 FIELD_LITERAL(0xffffffffffffff, 0xffffffffffffff, 0xffffffffffffff, -

16 0xffffffffffffff, 0xfffffffffffffe, 0xffffffffffffff, -

17 0xffffffffffffff, 0xffffffffffffff) -

18 }; -

19 -

20 /* Serialize to wire format. */ -

21 void gf_serialize(uint8_t serial[SER_BYTES], const gf x, int with_hibit) -

22 { -

23 unsigned int j = 0, fill = 0; -

24 dword_t buffer = 0; -

25 int i; -

26 gf red; -

27 -

28 gf_copy(red, x); -

29 gf_strong_reduce(red); -

if (!with_hibit)

!with_hibit	Description
TRUE	never evaluated
FALSE	evaluated 1136 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1

0-1136

assert(gf_hibit(red) == 0);

never executed: ((void) (0)) ;

32 -

for (i = 0; i < (with_hibit ? X_SER_BYTES : SER_BYTES); i++) {

i < (with_hibit ? 56 : 56)	Description
TRUE	evaluated 63616 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1
FALSE	evaluated 1136 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1

1136-63616

if (fill < 8 && j < NLIMBS) {

fill < 8	Description
TRUE	evaluated 18176 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1
FALSE	evaluated 45440 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1

j < (64/sizeof(word_t))	Description
TRUE	evaluated 18176 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1
FALSE	never evaluated

0-45440

35 buffer |= ((dword_t) red->limb[LIMBPERM(j)]) << fill; -

36 fill += LIMB_PLACE_VALUE(LIMBPERM(j)); -

37 j++; -

}

executed 18176 times by 2 tests: end of block

Executed by:

curve448_internal_test
libcrypto.so.1.1

18176

39 serial[i] = (uint8_t)buffer; -

40 fill -= 8; -

41 buffer >>= 8; -

}

executed 63616 times by 2 tests: end of block

Executed by:

curve448_internal_test
libcrypto.so.1.1

63616

}

executed 1136 times by 2 tests: end of block

Executed by:

curve448_internal_test
libcrypto.so.1.1

1136

44 -

45 /* Return high bit of x = low bit of 2x mod p */ -

46 mask_t gf_hibit(const gf x) -

47 { -

48 gf y; -

49 -

50 gf_add(y, x, x); -

51 gf_strong_reduce(y); -

return 0 - (y->limb[0] & 1);

never executed: return 0 - (y->limb[0] & 1);

53 } -

54 -

55 /* Return high bit of x = low bit of 2x mod p */ -

56 mask_t gf_lobit(const gf x) -

57 { -

58 gf y; -

59 -

60 gf_copy(y, x); -

61 gf_strong_reduce(y); -

return 0 - (y->limb[0] & 1);

executed 81 times by 2 tests: return 0 - (y->limb[0] & 1);

Executed by:

curve448_internal_test
libcrypto.so.1.1

63 } -

64 -

65 /* Deserialize from wire format; return -1 on success and 0 on failure. */ -

66 mask_t gf_deserialize(gf x, const uint8_t serial[SER_BYTES], int with_hibit, -

67 uint8_t hi_nmask) -

68 { -

69 unsigned int j = 0, fill = 0; -

70 dword_t buffer = 0; -

71 dsword_t scarry = 0; -

const unsigned nbytes = with_hibit ? X_SER_BYTES : SER_BYTES;

with_hibit	Description
TRUE	evaluated 1032 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1
FALSE	never evaluated

0-1032

73 unsigned int i; -

74 mask_t succ; -

75 -

for (i = 0; i < NLIMBS; i++) {

i < (64/sizeof(word_t))	Description
TRUE	evaluated 16512 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1
FALSE	evaluated 1032 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1

1032-16512

while (fill < LIMB_PLACE_VALUE(LIMBPERM(i)) && j < nbytes) {

fill < 28	Description
TRUE	evaluated 57792 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1
FALSE	evaluated 16512 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1

j < nbytes	Description
TRUE	evaluated 57792 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1
FALSE	never evaluated

0-57792

78 uint8_t sj; -

79 -

80 sj = serial[j]; -

if (j == nbytes - 1)

j == nbytes - 1	Description
TRUE	evaluated 1032 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1
FALSE	evaluated 56760 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1

1032-56760

sj &= ~hi_nmask;

executed 1032 times by 2 tests: sj &= ~hi_nmask;

Executed by:

curve448_internal_test
libcrypto.so.1.1

1032

83 buffer |= ((dword_t) sj) << fill; -

84 fill += 8; -

85 j++; -

}

executed 57792 times by 2 tests: end of block

Executed by:

curve448_internal_test
libcrypto.so.1.1

57792

87 x->limb[LIMBPERM(i)] = (word_t) -

((i < NLIMBS - 1) ? buffer & LIMB_MASK(LIMBPERM(i)) : buffer);

(i < (64/sizeof(word_t)) - 1)	Description
TRUE	evaluated 15480 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1
FALSE	evaluated 1032 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1

1032-15480

89 fill -= LIMB_PLACE_VALUE(LIMBPERM(i)); -

90 buffer >>= LIMB_PLACE_VALUE(LIMBPERM(i)); -

91 scarry = -

92 (scarry + x->limb[LIMBPERM(i)] - -

93 MODULUS->limb[LIMBPERM(i)]) >> (8 * sizeof(word_t)); -

}

executed 16512 times by 2 tests: end of block

Executed by:

curve448_internal_test
libcrypto.so.1.1

16512

succ = with_hibit ? 0 - (mask_t) 1 : ~gf_hibit(x);

with_hibit	Description
TRUE	evaluated 1032 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1
FALSE	never evaluated

0-1032

return succ & word_is_zero((word_t)buffer) & ~word_is_zero((word_t)scarry);

executed 1032 times by 2 tests: return succ & constant_time_is_zero_32((word_t)buffer) & ~constant_time_is_zero_32((word_t)scarry);

Executed by:

curve448_internal_test
libcrypto.so.1.1

1032

97 } -

98 -

99 /* Reduce to canonical form. */ -

100 void gf_strong_reduce(gf a) -

101 { -

102 dsword_t scarry; -

103 word_t scarry_0; -

104 dword_t carry = 0; -

105 unsigned int i; -

106 -

107 /* first, clear high */ -

108 gf_weak_reduce(a); /* Determined to have negligible perf impact. */ -

109 -

110 /* now the total is less than 2p */ -

111 -

112 /* compute total_value - p. No need to reduce mod p. */ -

113 scarry = 0; -

114

for (i = 0; i < NLIMBS; i++) {

i < (64/sizeof(word_t))	Description
TRUE	evaluated 54304 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1
FALSE	evaluated 3394 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1

3394-54304

115 scarry = scarry + a->limb[LIMBPERM(i)] - MODULUS->limb[LIMBPERM(i)]; -

116 a->limb[LIMBPERM(i)] = scarry & LIMB_MASK(LIMBPERM(i)); -

117 scarry >>= LIMB_PLACE_VALUE(LIMBPERM(i)); -

118

}

executed 54304 times by 2 tests: end of block

Executed by:

curve448_internal_test
libcrypto.so.1.1

54304

119 -

120 /* -

121 * uncommon case: it was >= p, so now scarry = 0 and this = x common case: -

122 * it was < p, so now scarry = -1 and this = x - p + 2^255 so let's add -

123 * back in p. will carry back off the top for 2^255. -

124 */ -

125 assert(scarry == 0 || scarry == -1); -

126 -

127 scarry_0 = (word_t)scarry; -

128 -

129 /* add it back */ -

130

for (i = 0; i < NLIMBS; i++) {

i < (64/sizeof(word_t))	Description
TRUE	evaluated 54304 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1
FALSE	evaluated 3394 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1

3394-54304

131 carry = -

132 carry + a->limb[LIMBPERM(i)] + -

133 (scarry_0 & MODULUS->limb[LIMBPERM(i)]); -

134 a->limb[LIMBPERM(i)] = carry & LIMB_MASK(LIMBPERM(i)); -

135 carry >>= LIMB_PLACE_VALUE(LIMBPERM(i)); -

136

}

executed 54304 times by 2 tests: end of block

Executed by:

curve448_internal_test
libcrypto.so.1.1

54304

137 -

138 assert(carry < 2 && ((word_t)carry + scarry_0) == 0); -

139

}

executed 3394 times by 2 tests: end of block

Executed by:

curve448_internal_test
libcrypto.so.1.1

3394

140 -

141 /* Subtract two gf elements d=a-b */ -

142 void gf_sub(gf d, const gf a, const gf b) -

143 { -

144 gf_sub_RAW(d, a, b); -

145 gf_bias(d, 2); -

146 gf_weak_reduce(d); -

147

}

executed 13765 times by 2 tests: end of block

Executed by:

curve448_internal_test
libcrypto.so.1.1

13765

148 -

149 /* Add two field elements d = a+b */ -

150 void gf_add(gf d, const gf a, const gf b) -

151 { -

152 gf_add_RAW(d, a, b); -

153 gf_weak_reduce(d); -

154

}

executed 536 times by 2 tests: end of block

Executed by:

curve448_internal_test
libcrypto.so.1.1

536

155 -

156 /* Compare a==b */ -

157 mask_t gf_eq(const gf a, const gf b) -

158 { -

159 gf c; -

160 mask_t ret = 0; -

161 unsigned int i; -

162 -

163 gf_sub(c, a, b); -

164 gf_strong_reduce(c); -

165 -

166

for (i = 0; i < NLIMBS; i++)

i < (64/sizeof(word_t))	Description
TRUE	evaluated 34832 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1
FALSE	evaluated 2177 times by 2 tests Evaluated by: curve448_internal_test libcrypto.so.1.1

2177-34832

167

ret |= c->limb[LIMBPERM(i)];

executed 34832 times by 2 tests: ret |= c->limb[(i)];

Executed by:

curve448_internal_test
libcrypto.so.1.1

34832

168 -

169

return word_is_zero(ret);

executed 2177 times by 2 tests: return constant_time_is_zero_32(ret);

Executed by:

curve448_internal_test
libcrypto.so.1.1

2177

170 } -

171 -

172 mask_t gf_isr(gf a, const gf x) -

173 { -

174 gf L0, L1, L2; -

175 -

176 gf_sqr(L1, x); -

177 gf_mul(L2, x, L1); -

178 gf_sqr(L1, L2); -

179 gf_mul(L2, x, L1); -

180 gf_sqrn(L1, L2, 3); -

181 gf_mul(L0, L2, L1); -

182 gf_sqrn(L1, L0, 3); -

183 gf_mul(L0, L2, L1); -

184 gf_sqrn(L2, L0, 9); -

185 gf_mul(L1, L0, L2); -

186 gf_sqr(L0, L1); -

187 gf_mul(L2, x, L0); -

188 gf_sqrn(L0, L2, 18); -

189 gf_mul(L2, L1, L0); -

190 gf_sqrn(L0, L2, 37); -

191 gf_mul(L1, L2, L0); -

192 gf_sqrn(L0, L1, 37); -

193 gf_mul(L1, L2, L0); -

194 gf_sqrn(L0, L1, 111); -

195 gf_mul(L2, L1, L0); -

196 gf_sqr(L0, L2); -

197 gf_mul(L1, x, L0); -

198 gf_sqrn(L0, L1, 223); -

199 gf_mul(L1, L2, L0); -

200 gf_sqr(L2, L1); -

201 gf_mul(L0, L2, x); -

202 gf_copy(a, L1); -

203

return gf_eq(L0, ONE);

executed 1154 times by 2 tests: return gf_eq(L0, ONE);

Executed by:

curve448_internal_test
libcrypto.so.1.1

1154

204 } -

Source code

Switch to Preprocessed file

Generated by Squish Coco 4.2.2