From ed091bddcec83ec4a292ce6faa0151e6f00efcb5 Mon Sep 17 00:00:00 2001 From: J08nY Date: Tue, 21 Nov 2023 17:26:56 +0100 Subject: Fixup some issues in library analysis. --- docs/libraries.rst | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) (limited to 'docs') diff --git a/docs/libraries.rst b/docs/libraries.rst index 4e22661..74e2051 100644 --- a/docs/libraries.rst +++ b/docs/libraries.rst @@ -32,7 +32,7 @@ Also more exotic stuff like ECMQV, GOST key exchange and signatures and lots of others. Lots of `scalarmults `__ available: - - `Comb `__ + - `Comb (w=6 for > 250 bits else w=5) `__ - `GLV `__ - `Window NAF L2R `__ - `Window "tau" NAF `__ @@ -160,7 +160,7 @@ P-224 ^^^^^ - Short-Weierstrass - `Comb `__ via ``mul_base -> ec_GFp_nistp224_point_mul_base``. - `Fixed Window `__ via ``mul -> ec_GFp_nistp224_point_mul``. + `Fixed Window (signed, Booth) (width=5) `__ via ``mul -> ec_GFp_nistp224_point_mul``. - `Jacobian `__, - Formulas unknown: `add-boringssl-p224 `__, `dbl-boringssl-p224 `__. @@ -169,7 +169,7 @@ P-256 ^^^^^ - Short-Weierstrass - `Comb `__ via ``mul_base -> ec_GFp_nistp256_point_mul_base``. - `Fixed Window `__ via ``mul -> ec_GFp_nistp256_point_mul``. + `Fixed Window (signed, Booth) (width=5) `__ via ``mul -> ec_GFp_nistp256_point_mul``. - `Jacobian-3 `__, - `add-2007-bl `__, `dbl-2001-b `__ @@ -278,7 +278,7 @@ ECDH KeyGen: - Short-Weierstrass - - Something like FullPrecomputation and Comb (no doublings), via ``blinded_base_point_multiply -> EC_Point_Base_Point_Precompute::mul``. + - `Fixed Window with FullPrecomputation (no doublings) (w=3) `__, via ``blinded_base_point_multiply -> EC_Point_Base_Point_Precompute::mul``. - `Jacobian `__ - `add-1998-cmo-2 `__ @@ -294,13 +294,13 @@ ECDSA KeyGen: - Short-Weierstrass - - Something like FullPrecomputation and Comb (no doublings), via ``blinded_base_point_multiply -> EC_Point_Base_Point_Precompute::mul``. + - `Fixed Window with FullPrecomputation (no doublings) (w=3) `__, via ``blinded_base_point_multiply -> EC_Point_Base_Point_Precompute::mul``. - `Jacobian `__ - `add-1998-cmo-2 `__ Sign: - Short-Weierstrass - - Something like FullPrecomputation and Comb (no doublings), via ``blinded_base_point_multiply -> EC_Point_Base_Point_Precompute::mul``. + - `Fixed Window with FullPrecomputation (no doublings) (w=3) `__, via ``blinded_base_point_multiply -> EC_Point_Base_Point_Precompute::mul``. - `Jacobian `__ - `add-1998-cmo-2 `__ @@ -313,11 +313,11 @@ Verify: X25519 ^^^^^^ -Based on curve2551_donna. +Based on curve25519_donna. Ed25519 ^^^^^^^ -Based on ref10 of Ed255119. +Based on ref10 of Ed25519. See `BoringSSL`_. @@ -440,13 +440,13 @@ ECDH KeyGen: - Short-Weierstrass - - `Montgomery ladder `__ via ``uECC_make_key -> EccPoint_compute_public_key -> EccPoint_mult`` (also has coordinate randomization). + - `Ladder (coZ, with subtraction) `__ via ``uECC_make_key -> EccPoint_compute_public_key -> EccPoint_mult`` (also has coordinate randomization). - `Jacobian coZ coordinates (Z1 == Z2) `__ from https://eprint.iacr.org/2011/338.pdf. - `coZ formulas `__ from https://eprint.iacr.org/2011/338.pdf. Derive: - Short-Weierstrass - - `Montgomery ladder `__ via ``uECC_shared_secret -> EccPoint_compute_public_key -> EccPoint_mult`` (also has coordinate randomization). + - `Ladder (coZ, with subtraction) `__ via ``uECC_shared_secret -> EccPoint_compute_public_key -> EccPoint_mult`` (also has coordinate randomization). - Same coords and formulas as KeyGen. ECDSA @@ -457,7 +457,7 @@ Keygen: Sign: - Short-Weierstrass - - `Montgomery ladder `__ via ``uECC_sign -> uECC_sign_with_k_internal -> EccPoint_mult`` (also has coordinate randomization). + - `Ladder (coZ, with subtraction) `__ via ``uECC_sign -> uECC_sign_with_k_internal -> EccPoint_mult`` (also has coordinate randomization). - Same coords and formulas as KeyGen. Verify: @@ -598,7 +598,7 @@ ECDH KeyGen: - Short-Weierstrass - - Ladder via ``kmethod.keygen -> ec_key_gen -> EC_POINT_mul -> method.mul_generator_ct -> ec_GFp_simple_mul_generator_ct -> ec_GFp_simple_mul_ct``. + - `Simple Ladder `__ via ``kmethod.keygen -> ec_key_gen -> EC_POINT_mul -> method.mul_generator_ct -> ec_GFp_simple_mul_generator_ct -> ec_GFp_simple_mul_ct``. Also does coordinate blinding and fixes scalar bit-length. - Jacobian coordinates. - Unknown formulas: `add-libressl-v382 `__, @@ -606,7 +606,7 @@ KeyGen: Derive: - Short-Weierstrass - - Ladder via ``kmethod.compute_key -> ecdh_compute_key -> EC_POINT_mul -> method.mul_single_ct -> ec_GFp_simple_mul_single_ct -> ec_GFp_simple_mul_ct``. + - `Simple Ladder `__ via ``kmethod.compute_key -> ecdh_compute_key -> EC_POINT_mul -> method.mul_single_ct -> ec_GFp_simple_mul_single_ct -> ec_GFp_simple_mul_ct``. Also does coordinate blinding and fixes scalar bit-length. - Same as KeyGen. @@ -619,24 +619,24 @@ KeyGen: Sign: - Short-Weierstrass - - Ladder via ``ECDSA_sign -> kmethod.sign -> ecdsa_sign -> ECDSA_do_sign -> kmethod.sign_sig -> ecdsa_sign_sig -> ECDSA_sign_setup -> kmethod.sign_setup -> ecdsa_sign_setup -> EC_POINT_mul -> method.mul_generator_ct -> ec_GFp_simple_mul_generator_ct -> ec_GFp_simple_mul_ct``. + - `Simple Ladder `__ via ``ECDSA_sign -> kmethod.sign -> ecdsa_sign -> ECDSA_do_sign -> kmethod.sign_sig -> ecdsa_sign_sig -> ECDSA_sign_setup -> kmethod.sign_setup -> ecdsa_sign_setup -> EC_POINT_mul -> method.mul_generator_ct -> ec_GFp_simple_mul_generator_ct -> ec_GFp_simple_mul_ct``. - Same as ECDH. Verify: - Short-Weierstrass - - Window NAF interleaving multi-exponentation method ``ECDSA_verify -> kmethod.verify -> ecdsa_verify -> ECDSA_do_verify -> kmethod.verify_sig -> ecdsa_verify_sig -> EC_POINT_mul -> method.mul_double_nonct -> ec_GFp_simple_mul_double_nonct -> ec_wNAF_mul``. + - Window NAF interleaving multi-exponentiation method ``ECDSA_verify -> kmethod.verify -> ecdsa_verify -> ECDSA_do_verify -> kmethod.verify_sig -> ecdsa_verify_sig -> EC_POINT_mul -> method.mul_double_nonct -> ec_GFp_simple_mul_double_nonct -> ec_wNAF_mul``. Refers to http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#multiexp and https://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#fastexp - Same coordinates and formulas as ECDH. X25519 ^^^^^^ -Based on ref10 of Ed255119. +Based on ref10 of Ed25519. See `BoringSSL`_. Not exactly the same. Ed25519 ^^^^^^^ -Based on ref10 of Ed255119. +Based on ref10 of Ed25519. See `BoringSSL`_. Not exactly the same. @@ -1174,11 +1174,11 @@ ECDH ^^^^ KeyGen: - - `Fixed 4-bit window with precomputation `__ with precomputation (link points to P-224, but others are the same) via ``privateKeyToPublicKey -> ScalarBaseMult`` + - `Fixed window (w=4) `__ (link points to P-224, but others are the same) via ``privateKeyToPublicKey -> ScalarBaseMult`` - Projective `add-2015-rcb `__ Derive: - - `Fixed 4-bit window `__ via ``ecdh -> ScalarMult``. + - `Fixed window (w=4) `__ via ``ecdh -> ScalarMult``. - Same formulas as in Keygen. Also supports constant-time, 64-bit assembly implementation of P256 described in https://eprint.iacr.org/2013/816.pdf -- cgit v1.3.1