OpenCoverage

f_generic.c

Absolute File Name:/home/opencoverage/opencoverage/guest-scripts/openssl/src/crypto/ec/curve448/f_generic.c
Source codeSwitch to Preprocessed file
LineSourceCount
1/*-
2 * Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.-
3 * Copyright 2015-2016 Cryptography Research, Inc.-
4 *-
5 * Licensed under the OpenSSL license (the "License"). You may not use-
6 * this file except in compliance with the License. You can obtain a copy-
7 * in the file LICENSE in the source distribution or at-
8 * https://www.openssl.org/source/license.html-
9 *-
10 * Originally written by Mike Hamburg-
11 */-
12#include "field.h"-
13-
14static const gf MODULUS = {-
15 FIELD_LITERAL(0xffffffffffffff, 0xffffffffffffff, 0xffffffffffffff,-
16 0xffffffffffffff, 0xfffffffffffffe, 0xffffffffffffff,-
17 0xffffffffffffff, 0xffffffffffffff)-
18};-
19-
20/* Serialize to wire format. */-
21void gf_serialize(uint8_t serial[SER_BYTES], const gf x, int with_hibit)-
22{-
23 unsigned int j = 0, fill = 0;-
24 dword_t buffer = 0;-
25 int i;-
26 gf red;-
27-
28 gf_copy(red, x);-
29 gf_strong_reduce(red);-
30 if (!with_hibit)
!with_hibitDescription
TRUEnever evaluated
FALSEevaluated 1136 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
0-1136
31 assert(gf_hibit(red) == 0);
never executed: ((void) (0)) ;
0
32-
33 for (i = 0; i < (with_hibit ? X_SER_BYTES : SER_BYTES); i++) {
i < (with_hibit ? 56 : 56)Description
TRUEevaluated 63616 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
FALSEevaluated 1136 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
1136-63616
34 if (fill < 8 && j < NLIMBS) {
fill < 8Description
TRUEevaluated 18176 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
FALSEevaluated 45440 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
j < (64/sizeof(word_t))Description
TRUEevaluated 18176 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
FALSEnever evaluated
0-45440
35 buffer |= ((dword_t) red->limb[LIMBPERM(j)]) << fill;-
36 fill += LIMB_PLACE_VALUE(LIMBPERM(j));-
37 j++;-
38 }
executed 18176 times by 2 tests: end of block
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
18176
39 serial[i] = (uint8_t)buffer;-
40 fill -= 8;-
41 buffer >>= 8;-
42 }
executed 63616 times by 2 tests: end of block
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
63616
43}
executed 1136 times by 2 tests: end of block
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
1136
44-
45/* Return high bit of x = low bit of 2x mod p */-
46mask_t gf_hibit(const gf x)-
47{-
48 gf y;-
49-
50 gf_add(y, x, x);-
51 gf_strong_reduce(y);-
52 return 0 - (y->limb[0] & 1);
never executed: return 0 - (y->limb[0] & 1);
0
53}-
54-
55/* Return high bit of x = low bit of 2x mod p */-
56mask_t gf_lobit(const gf x)-
57{-
58 gf y;-
59-
60 gf_copy(y, x);-
61 gf_strong_reduce(y);-
62 return 0 - (y->limb[0] & 1);
executed 81 times by 2 tests: return 0 - (y->limb[0] & 1);
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
81
63}-
64-
65/* Deserialize from wire format; return -1 on success and 0 on failure. */-
66mask_t gf_deserialize(gf x, const uint8_t serial[SER_BYTES], int with_hibit,-
67 uint8_t hi_nmask)-
68{-
69 unsigned int j = 0, fill = 0;-
70 dword_t buffer = 0;-
71 dsword_t scarry = 0;-
72 const unsigned nbytes = with_hibit ? X_SER_BYTES : SER_BYTES;
with_hibitDescription
TRUEevaluated 1032 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
FALSEnever evaluated
0-1032
73 unsigned int i;-
74 mask_t succ;-
75-
76 for (i = 0; i < NLIMBS; i++) {
i < (64/sizeof(word_t))Description
TRUEevaluated 16512 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
FALSEevaluated 1032 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
1032-16512
77 while (fill < LIMB_PLACE_VALUE(LIMBPERM(i)) && j < nbytes) {
fill < 28Description
TRUEevaluated 57792 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
FALSEevaluated 16512 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
j < nbytesDescription
TRUEevaluated 57792 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
FALSEnever evaluated
0-57792
78 uint8_t sj;-
79-
80 sj = serial[j];-
81 if (j == nbytes - 1)
j == nbytes - 1Description
TRUEevaluated 1032 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
FALSEevaluated 56760 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
1032-56760
82 sj &= ~hi_nmask;
executed 1032 times by 2 tests: sj &= ~hi_nmask;
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
1032
83 buffer |= ((dword_t) sj) << fill;-
84 fill += 8;-
85 j++;-
86 }
executed 57792 times by 2 tests: end of block
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
57792
87 x->limb[LIMBPERM(i)] = (word_t)-
88 ((i < NLIMBS - 1) ? buffer & LIMB_MASK(LIMBPERM(i)) : buffer);
(i < (64/sizeof(word_t)) - 1)Description
TRUEevaluated 15480 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
FALSEevaluated 1032 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
1032-15480
89 fill -= LIMB_PLACE_VALUE(LIMBPERM(i));-
90 buffer >>= LIMB_PLACE_VALUE(LIMBPERM(i));-
91 scarry =-
92 (scarry + x->limb[LIMBPERM(i)] --
93 MODULUS->limb[LIMBPERM(i)]) >> (8 * sizeof(word_t));-
94 }
executed 16512 times by 2 tests: end of block
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
16512
95 succ = with_hibit ? 0 - (mask_t) 1 : ~gf_hibit(x);
with_hibitDescription
TRUEevaluated 1032 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
FALSEnever evaluated
0-1032
96 return succ & word_is_zero((word_t)buffer) & ~word_is_zero((word_t)scarry);
executed 1032 times by 2 tests: return succ & constant_time_is_zero_32((word_t)buffer) & ~constant_time_is_zero_32((word_t)scarry);
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
1032
97}-
98-
99/* Reduce to canonical form. */-
100void gf_strong_reduce(gf a)-
101{-
102 dsword_t scarry;-
103 word_t scarry_0;-
104 dword_t carry = 0;-
105 unsigned int i;-
106-
107 /* first, clear high */-
108 gf_weak_reduce(a); /* Determined to have negligible perf impact. */-
109-
110 /* now the total is less than 2p */-
111-
112 /* compute total_value - p. No need to reduce mod p. */-
113 scarry = 0;-
114 for (i = 0; i < NLIMBS; i++) {
i < (64/sizeof(word_t))Description
TRUEevaluated 54304 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
FALSEevaluated 3394 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
3394-54304
115 scarry = scarry + a->limb[LIMBPERM(i)] - MODULUS->limb[LIMBPERM(i)];-
116 a->limb[LIMBPERM(i)] = scarry & LIMB_MASK(LIMBPERM(i));-
117 scarry >>= LIMB_PLACE_VALUE(LIMBPERM(i));-
118 }
executed 54304 times by 2 tests: end of block
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
54304
119-
120 /*-
121 * uncommon case: it was >= p, so now scarry = 0 and this = x common case:-
122 * it was < p, so now scarry = -1 and this = x - p + 2^255 so let's add-
123 * back in p. will carry back off the top for 2^255.-
124 */-
125 assert(scarry == 0 || scarry == -1);-
126-
127 scarry_0 = (word_t)scarry;-
128-
129 /* add it back */-
130 for (i = 0; i < NLIMBS; i++) {
i < (64/sizeof(word_t))Description
TRUEevaluated 54304 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
FALSEevaluated 3394 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
3394-54304
131 carry =-
132 carry + a->limb[LIMBPERM(i)] +-
133 (scarry_0 & MODULUS->limb[LIMBPERM(i)]);-
134 a->limb[LIMBPERM(i)] = carry & LIMB_MASK(LIMBPERM(i));-
135 carry >>= LIMB_PLACE_VALUE(LIMBPERM(i));-
136 }
executed 54304 times by 2 tests: end of block
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
54304
137-
138 assert(carry < 2 && ((word_t)carry + scarry_0) == 0);-
139}
executed 3394 times by 2 tests: end of block
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
3394
140-
141/* Subtract two gf elements d=a-b */-
142void gf_sub(gf d, const gf a, const gf b)-
143{-
144 gf_sub_RAW(d, a, b);-
145 gf_bias(d, 2);-
146 gf_weak_reduce(d);-
147}
executed 13765 times by 2 tests: end of block
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
13765
148-
149/* Add two field elements d = a+b */-
150void gf_add(gf d, const gf a, const gf b)-
151{-
152 gf_add_RAW(d, a, b);-
153 gf_weak_reduce(d);-
154}
executed 536 times by 2 tests: end of block
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
536
155-
156/* Compare a==b */-
157mask_t gf_eq(const gf a, const gf b)-
158{-
159 gf c;-
160 mask_t ret = 0;-
161 unsigned int i;-
162-
163 gf_sub(c, a, b);-
164 gf_strong_reduce(c);-
165-
166 for (i = 0; i < NLIMBS; i++)
i < (64/sizeof(word_t))Description
TRUEevaluated 34832 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
FALSEevaluated 2177 times by 2 tests
Evaluated by:
  • curve448_internal_test
  • libcrypto.so.1.1
2177-34832
167 ret |= c->limb[LIMBPERM(i)];
executed 34832 times by 2 tests: ret |= c->limb[(i)];
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
34832
168-
169 return word_is_zero(ret);
executed 2177 times by 2 tests: return constant_time_is_zero_32(ret);
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
2177
170}-
171-
172mask_t gf_isr(gf a, const gf x)-
173{-
174 gf L0, L1, L2;-
175-
176 gf_sqr(L1, x);-
177 gf_mul(L2, x, L1);-
178 gf_sqr(L1, L2);-
179 gf_mul(L2, x, L1);-
180 gf_sqrn(L1, L2, 3);-
181 gf_mul(L0, L2, L1);-
182 gf_sqrn(L1, L0, 3);-
183 gf_mul(L0, L2, L1);-
184 gf_sqrn(L2, L0, 9);-
185 gf_mul(L1, L0, L2);-
186 gf_sqr(L0, L1);-
187 gf_mul(L2, x, L0);-
188 gf_sqrn(L0, L2, 18);-
189 gf_mul(L2, L1, L0);-
190 gf_sqrn(L0, L2, 37);-
191 gf_mul(L1, L2, L0);-
192 gf_sqrn(L0, L1, 37);-
193 gf_mul(L1, L2, L0);-
194 gf_sqrn(L0, L1, 111);-
195 gf_mul(L2, L1, L0);-
196 gf_sqr(L0, L2);-
197 gf_mul(L1, x, L0);-
198 gf_sqrn(L0, L1, 223);-
199 gf_mul(L1, L2, L0);-
200 gf_sqr(L2, L1);-
201 gf_mul(L0, L2, x);-
202 gf_copy(a, L1);-
203 return gf_eq(L0, ONE);
executed 1154 times by 2 tests: return gf_eq(L0, ONE);
Executed by:
  • curve448_internal_test
  • libcrypto.so.1.1
1154
204}-
Source codeSwitch to Preprocessed file

Generated by Squish Coco 4.2.2