1 /*******************************************************************************
2 * Copyright 2018 Intel Corporation
3 * All Rights Reserved.
4 *
5 * If this software was obtained under the Intel Simplified Software License,
6 * the following terms apply:
7 *
8 * The source code, information and material ("Material") contained herein is
9 * owned by Intel Corporation or its suppliers or licensors, and title to such
10 * Material remains with Intel Corporation or its suppliers or licensors. The
11 * Material contains proprietary information of Intel or its suppliers and
12 * licensors. The Material is protected by worldwide copyright laws and treaty
13 * provisions. No part of the Material may be used, copied, reproduced,
14 * modified, published, uploaded, posted, transmitted, distributed or disclosed
15 * in any way without Intel's prior express written permission. No license under
16 * any patent, copyright or other intellectual property rights in the Material
17 * is granted to or conferred upon you, either expressly, by implication,
18 * inducement, estoppel or otherwise. Any license under such intellectual
19 * property rights must be express and approved by Intel in writing.
20 *
21 * Unless otherwise agreed by Intel in writing, you may not remove or alter this
22 * notice or any other notice embedded in Materials by Intel or Intel's
23 * suppliers or licensors in any way.
24 *
25 *
26 * If this software was obtained under the Apache License, Version 2.0 (the
27 * "License"), the following terms apply:
28 *
29 * You may not use this file except in compliance with the License. You may
30 * obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
31 *
32 *
33 * Unless required by applicable law or agreed to in writing, software
34 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
35 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
36 *
37 * See the License for the specific language governing permissions and
38 * limitations under the License.
39 *******************************************************************************/
40
41 /*
42 // Intel(R) Integrated Performance Primitives. Cryptography Primitives.
43 // Internal operations over prime GF(p).
44 //
45 // Context:
46 // cpGFpSqrt
47 //
48 */
49 #include "owncp.h"
50
51 #include "pcpbn.h"
52 #include "pcpgfpstuff.h"
53
54 //tbcd: temporary excluded: #include <assert.h>
55
factor2(BNU_CHUNK_T * pA,int nsA)56 static int factor2(BNU_CHUNK_T* pA, int nsA)
57 {
58 int factor = 0;
59 int bits;
60
61 int i;
62 for(i=0; i<nsA; i++) {
63 int ntz = cpNTZ_BNU(pA[i]);
64 factor += ntz;
65 if(ntz<BITSIZE(BNU_CHUNK_T))
66 break;
67 }
68
69 bits = factor;
70 if(bits >= BITSIZE(BNU_CHUNK_T)) {
71 int nchunk = bits/BITSIZE(BNU_CHUNK_T);
72 cpGFpElementCopyPadd(pA, nsA, pA+nchunk, nsA-nchunk);
73 bits %= BITSIZE(BNU_CHUNK_T);
74 }
75 if(bits)
76 cpLSR_BNU(pA, pA, nsA, bits);
77
78 return factor;
79 }
80
cpGFpExp2(BNU_CHUNK_T * pR,const BNU_CHUNK_T * pA,int e,gsModEngine * pGFE)81 static BNU_CHUNK_T* cpGFpExp2(BNU_CHUNK_T* pR, const BNU_CHUNK_T* pA, int e, gsModEngine* pGFE)
82 {
83 cpGFpElementCopy(pR, pA, GFP_FELEN(pGFE));
84 while(e--) {
85 GFP_METHOD(pGFE)->sqr(pR, pR, pGFE);
86 }
87 return pR;
88 }
89
90
91 /* returns:
92 0, if a - qnr
93 1, if sqrt is found
94 */
cpGFpSqrt(BNU_CHUNK_T * pR,const BNU_CHUNK_T * pA,gsModEngine * pGFE)95 int cpGFpSqrt(BNU_CHUNK_T* pR, const BNU_CHUNK_T* pA, gsModEngine* pGFE)
96 {
97 int elemLen = GFP_FELEN(pGFE);
98 int poolelementLen = GFP_PELEN(pGFE);
99 int resultFlag = 1;
100
101 /* case A==0 */
102 if( GFP_IS_ZERO(pA, elemLen) )
103 cpGFpElementPadd(pR, elemLen, 0);
104
105 /* general case */
106 else {
107 BNU_CHUNK_T* q = cpGFpGetPool(4, pGFE);
108 BNU_CHUNK_T* x = q + poolelementLen;
109 BNU_CHUNK_T* y = x + poolelementLen;
110 BNU_CHUNK_T* z = y + poolelementLen;
111
112 int s;
113
114 //tbcd: temporary excluded: assert(q!=NULL);
115
116 /* z=1 */
117 GFP_ONE(z, elemLen);
118
119 /* (modulus-1) = 2^s*q */
120 cpSub_BNU(q, GFP_MODULUS(pGFE), z, elemLen);
121 s = factor2(q, elemLen);
122
123 /*
124 // initialization
125 */
126
127 /* y = qnr^q */
128 cpGFpExp(y, GFP_QNR(pGFE), q,elemLen, pGFE);
129 /* x = a^((q-1)/2) */
130 cpSub_BNU(q, q, z, elemLen);
131 cpLSR_BNU(q, q, elemLen, 1);
132 cpGFpExp(x, pA, q, elemLen, pGFE);
133 /* z = a*x^2 */
134 GFP_METHOD(pGFE)->mul(z, x, x, pGFE);
135 GFP_METHOD(pGFE)->mul(z, pA, z, pGFE);
136 /* R = a*x */
137 GFP_METHOD(pGFE)->mul(pR, pA, x, pGFE);
138
139 while( !GFP_EQ(z, MOD_MNT_R(pGFE), elemLen) ) {
140 int m = 0;
141 cpGFpElementCopy(q, z, elemLen);
142
143 for(m=1; m<s; m++) {
144 GFP_METHOD(pGFE)->mul(q, q, q, pGFE);
145 if( GFP_EQ(q, MOD_MNT_R(pGFE), elemLen) )
146 break;
147 }
148
149 if(m==s) {
150 /* A is quadratic non-residue */
151 resultFlag = 0;
152 break;
153 }
154 else {
155 /* exponent reduction */
156 cpGFpExp2(q, y, (s-m-1), pGFE); /* q = y^(2^(s-m-1)) */
157 GFP_METHOD(pGFE)->mul(y, q, q, pGFE); /* y = q^2 */
158 GFP_METHOD(pGFE)->mul(pR, q, pR, pGFE); /* R = q*R */
159 GFP_METHOD(pGFE)->mul(z, y, z, pGFE); /* z = z*y */
160 s = m;
161 }
162 }
163
164 /* choose smallest between R and (modulus-R) */
165 GFP_METHOD(pGFE)->decode(q, pR, pGFE);
166 if(GFP_GT(q, GFP_HMODULUS(pGFE), elemLen))
167 GFP_METHOD(pGFE)->neg(pR, pR, pGFE);
168
169 cpGFpReleasePool(4, pGFE);
170 }
171
172 return resultFlag;
173 }
174