You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 

383 lines
17 KiB

  1. April 23, 2015:
  2. Removed the original Goldilocks code; Decaf now stands on its own.
  3. This cuts the source code approximately in half, to a still-large
  4. 13.7k wc-lines. (Most of these lines are in the arch-specific
  5. field implementations.)
  6. Note that the decaf_crypto routines are not intended to set
  7. standards. They should be secure, but they're intended more as
  8. examples of how the core ECC library could be used.
  9. The SHAKE stuff is also mostly an experiment, particularly the
  10. STROBE protocol/mode stuff. This is all fine, because the ECC
  11. library itself is the core, and doesn't require the SHAKE stuff.
  12. (Except for the C++ header, which should probably also be factored
  13. so that it doesn't need the SHAKE stuff.)
  14. I've started work on making a Decaf BAT, but not done yet.
  15. I haven't ripped out all old multi-field code, because I intend
  16. to add support for other fields eventually. Maybe properly this
  17. time, instead of with a million compile flags like the original.
  18. March 23, 2015:
  19. I've been fleshing out Decaf, and hopefully the API is somewhere
  20. near final. I will probably move a few things around and add a
  21. scalar inversion command (for AugPAKE and such).
  22. I've built a "decaf_fast" implementation which is about as fast as
  23. Goldilocks, except that verification still isn't as fast, because
  24. it needs a precomputed wNAF table which I haven't implemented yet.
  25. Precomputation is noticeably faster than in Goldilocks; while
  26. neither is especially optimized, the extended point format works
  27. slightly better for that purpose.
  28. While optimizing decaf_fast I also found a minor perf problem in
  29. the constant time lookup code, so that's fixed (I hope?) and
  30. everything is faster at least on my test machine.
  31. At some point soon-ish, I'd like to start removing the base
  32. Goldilocks code from this branch. That will require porting more
  33. of the tests. I might make a C++ header for Decaf, which would
  34. definitely simplify testing.
  35. March 1, 2015:
  36. While by no means complete or stable, I've done most of the ground
  37. work to implement the "Decaf" point encoding. This point encoding
  38. essentially divides the cofactor by 4, turning Goldilocks (or
  39. Ridinghood or E-521) into a prime-order group. Furthermore, like
  40. the Goldilocks encoding, this encoding avoids incompleteness in
  41. the twisted Edwards formulas with a=-1 by sticking to the order-2q
  42. subgroup.
  43. Because the group is prime order, and because the "isogeny strategy"
  44. is not needed, the decaf API can be very simple. I'm still working
  45. on exactly what it should be though. The goal is to have a single-
  46. file (or a few files) for a "ref" version, which is designed for
  47. auditability. The ref version won't be quite so simple as TweetNaCl,
  48. but nearly so simple and much better commented. Then there can also
  49. be an optimized version, perhaps per-platform, which is as fast as
  50. the original Goldilocks code but hopefully still simpler.
  51. I'm experimenting with SHAKE as the hash function here. Possibly I
  52. will also add Keyak as an encryption primitive, so that everything
  53. can be based on Keccak-f, but I'm open to suggestions. For example,
  54. if there's a way to make BLAKE2 as simple and useful as SHAKE
  55. (including in oversized curves like E-521), then the extra speed
  56. would certainly be welcome.
  57. October 27, 2014:
  58. Added more support for >512-bit primes. Changed shared secret
  59. to not overflow the buffer in this case. Changed hashing to
  60. SHA512-PRNG; this doesn't change the behavior in the case that
  61. only one block is required.
  62. E-521 appears to be working. Needs more testing, and maybe some
  63. careful analysis since the carry-handling bounds are awfully tight
  64. under the current analysis (the "< 5<<57" that it #if0 asserts is
  65. not actually tight enough under the current analysis; need
  66. it to be < (1+epsilon) << 59).
  67. So you actually do need to reduce often, at least in the x86_64_r12
  68. version.
  69. p521/arch_ref64: simple and relatively slow impl. Like
  70. p448/arch_ref64, this arch reduces after every add or sub.
  71. p521/arch_x86_64_r12: aggressive, fast implementation. This impl
  72. stores 521 bits not in 9 limbs, but 12! Limbs 3,7,11 are 0, and
  73. are there only for vector alignment. (TODO: remove those limbs
  74. from precomputed tables, so that we don't have to look them up!).
  75. The carry handling on this build is very tight, and probably could
  76. stand more analysis. This is why I have the careful balancing of
  77. "hexad" and "nonad" multiplies in its Chung-Hasan mul routine.
  78. (TODO: reconsider whether this is even worthwhile on machines
  79. without AVX2.)
  80. The 'r12 build is a work in progress, and currently only works on
  81. clang (because it rearranges vectors in the timesW function).
  82. Timings for the fast, aggressive arch on Haswell:
  83. mul: 146cy
  84. sqr: 111cy
  85. invert: 62kcy
  86. keygen: 270kcy
  87. ecdh: 803kcy
  88. sign: 283kcy
  89. verif: 907kcy
  90. Same rules as other Goldi benchmarks. Turbo off, HT off,
  91. timing-channel protected (no dataflow from secrets to branches,
  92. memory lookups or known vt instructions), compressed points.
  93. October 23, 2014:
  94. Pushing through changes for curve flexibility. First up is
  95. Ed480-Ridinghood, because it has the same number of words. Next
  96. is E-521.
  97. Experimental support for Ed480-Ridinghood. To use, compile with
  98. make ... FIELD=p480 -XCFLAGS=-DGOLDI_FIELD_BITS=480
  99. I still need to figure out what to do about the fact that the library
  100. is called "goldilocks", but in will soon support curves that are not
  101. ed448-goldilocks, at least experimentally.
  102. Currently the whole system's header "goldilocks.h" doesn't have
  103. a simpler way to override field size, but it does work (as a hack)
  104. with -DGOLDI_FIELD_BITS=...
  105. There is no support yet for coexistence of multiple fields in one
  106. library. The field routines will have unique names, but scalarmul*
  107. won't, and the top-level goldilocks routines have fixed names.
  108. Current timings on Haswell:
  109. Goldilocks: 178kcy keygen, 536kcy ecdh
  110. Ridinghood: 193kcy keygen, 617kcy ecdh
  111. Note that Ridinghood ECDH does worse than 480/448. This is at least
  112. in part because I haven't calculated the overflow handling limits yet
  113. in ec_point.h (this is a disadvantage of dropping the automated
  114. tool for generating that file). So I'm reducing much more often
  115. than I need to. (There's a really loud TODO in ec_point.h for that.)
  116. Also, I haven't tested the limits on these reductions in a while, so
  117. it could be that there are actual (security-critical) bugs in this
  118. area, at least for p448. Now that there's field flexibility, it's
  119. probably a good idea to make a field impl with extra words to check
  120. this.
  121. Furthermore, field_mulw_scc will perform differently on these two
  122. curves based on whether the curve constant is positive or negative.
  123. I should probably go optimize the "hot" routines like montgomery_step
  124. to have separate cases for positive and negative.
  125. September 29, 2014:
  126. Yesterday I put in some more architecture detection, but it should
  127. really be based on the arch directory, because what's in there really
  128. was a terrible hack. So I've changed it to use $arch/arch_config.h
  129. to get WORD_BITS.
  130. I've tweaked the eBAT construction code to rename the architectures
  131. using test/batarch.map. Maybe I should also rename them internally,
  132. but not yet.
  133. I added some new TODO.txt items. Some folks have been asking for a
  134. more factored library, instead of this combined arithmetic, curve code,
  135. encodings and protocol all-in-one jumble. Likewise the hash and RNG
  136. should be flexible.
  137. I've also been meaning to put more work in on SPAKE2EE, which would
  138. also mean finalizing the Elligator code.
  139. September 18, 2014:
  140. Begin work on a "ref" implementation. Currently this is just the
  141. arch_ref64 architecture. The ref implementation always weak_reduces
  142. after arithmetic, and doesn't use vectors or other hackery. Currently
  143. it still must declare field elements as vector aligned, though,
  144. other code outside the arch directory can be vectorized.
  145. Change goldilocks.c to use field_eq instead of calling deep into field
  146. apis.
  147. September 6, 2014:
  148. Pull in minor changes from David Leon Gil and Nicholas Wilson, with
  149. some adjustments. I hope the adjustments don't break their compiles.
  150. `make bat` now makes a bat which passes supercop-fastbuild, though
  151. the benchmarks are rather different from `make bench`. I need to track
  152. down why.
  153. August 4, 2014:
  154. Experiments and bug fixes.
  155. Add really_memset = memset_s (except not because I'm setting -std=c99),
  156. thanks David Leon Gil. I think I put it in the right places.
  157. Try to work around what I think is a compiler bug in GCC -O3 on non-AVX
  158. platforms. I can't seem to work around it as -Os, so I'm just flagging
  159. a warning (-Werror makes it an error) for now. Will take more
  160. investigation. Thanks Samuel Neves.
  161. Added an experimental (not ready yet!) ARM NEON implementation in
  162. arch_neon_experimental. This implementation seems to work, but needs
  163. more testing. It is currently asm-heavy and not GCC clean. I am
  164. planning to have a flag for it to use intrinsics instead of asm;
  165. currently the intrinsics are commented out. On clang this does ECDH
  166. in 1850kcy on my BeagleBone Black, comparable to Curve41417. Once this
  167. is ready, I will probably move it to arch_neon proper, since arch_neon
  168. isn't particularly tuned.
  169. July 11, 2014:
  170. This is mostly a cleanup release.
  171. Added CRANDOM_MIGHT_IS_MUST config flag (default: 1). When set, this
  172. causes crandom to assume that all features in the target arch will
  173. be available, instead of detecting them. This makes sense because
  174. the rest of the Goldilocks code is not (yet?) able to detect features.
  175. Also, I'd like to submit this to SUPERCOP eventually, and SUPERCOP won't
  176. pass -DMUST_HAVE_XXX on the command line the way the Makefile here did.
  177. Flag EXPERIMENT_CRANDOM_BUFFER_CUTOFF_BYTES to disable the crandom
  178. output buffer. This buffer improves performance (very marginally at
  179. Goldilocks sizes), but can cause problems with forking and VM
  180. snapshotting. By default, the buffer is now disabled.
  181. I've slightly tweaked the Elligator implementation (which is still
  182. unused) to make it easier to invert. This makes anything using Elligator
  183. (i.e. nothing) incompatible with previous releases.
  184. I've been factoring "magic" constants such as curve orders, window sizes,
  185. etc into a few headers, to reduce the effort to port the code to other
  186. primes, curves, etc. For example, I could test the Microsoft curves, and
  187. something like:
  188. x^2 + y^2 = 1 +- 5382[45] x^2 y^2 mod 2^480-2^240-1
  189. ("Goldeneye"? "Ridinghood"?) might be a reasonable thing to try for
  190. 64-bit CPUs.
  191. In a similar vein, most of the internal code has been changed to say
  192. "field" instead of p448, so that a future version of magic.h can decide
  193. which field header to include.
  194. You can now `make bat` to create an eBAT in build/ed448-goldilocks. This
  195. is only minimally tested, though, because SUPERCOP doesn't work on my
  196. machine and I'm too lazy to reverse engineer it. It sets a new macro,
  197. SUPERCOP_WONT_LET_ME_OPEN_FILES, which causes goldilocks_init() to fall
  198. back to something horribly insecure if crandom_init_from_file raises
  199. EMFILE.
  200. Slightly improved documentation.
  201. Removed some old commented-out code; restored the /* C-style */ comment
  202. discipline.
  203. The AMD-64 version should now be GCC clean, at least for reasonably
  204. recent GCC (tested on OS X.9.3, Haswell, gcc-4.9).
  205. History no longer says "2104".
  206. May 3, 2014:
  207. Minor changes to internal routines mean that this version is not
  208. compatible with the previous one.
  209. Added ARM NEON code.
  210. Added the ability to precompute multiples of a partner's public key. This
  211. takes slightly longer than a signature verification, but reduces future
  212. verifications with the precomputed key by ~63% and ECDH by ~70%.
  213. goldilocks_precompute_public_key
  214. goldilocks_destroy_precomputed_public_key
  215. goldilocks_verify_precomputed
  216. goldilocks_shared_secret_precomputed
  217. The precomputation feature are is protected by a macro
  218. GOLDI_IMPLEMENT_PRECOMPUTED_KEYS
  219. which can be #defined to 0 to compile these functions out. Unlike most
  220. of Goldilocks' functions, goldilocks_precompute_public_key uses malloc()
  221. (and goldilocks_destroy_precomputed_public_key uses free()).
  222. Changed private keys to be derived from just the symmetric part. This
  223. means that you can compress them to 32 bytes for cold storage, or derive
  224. keypairs from crypto secrets from other systems.
  225. goldilocks_derive_private_key
  226. goldilocks_underive_private_key
  227. goldilocks_private_to_public
  228. Fixed a number of bugs related to vector alignment on Sandy Bridge, which
  229. has AVX but uses SSE2 alignment (because it doesn't have AVX2). Maybe I
  230. should just switch it to use AVX2 alignment?
  231. Beginning to factor out curve-specific magic, so as to build other curves
  232. with the Goldilocks framework. That would enable fair tests against eg
  233. E-521, Ed25519 etc. Still would be a lot of work.
  234. More thorough testing of arithmetic. Now uses GMP for testing framework,
  235. but not in the actual library.
  236. Added some high-level tests for the whole library, including some (bs)
  237. negative testing. Obviously, effective negative testing is a very difficult
  238. proposition in a crypto library.
  239. March 29, 2014:
  240. Added a test directory with various tests. Currently testing SHA512 Monte
  241. Carlo, compatibility of the different scalarmul functions, and some
  242. identities on EC point ops. Began moving these tests out of benchmarker.
  243. Added scan-build support.
  244. Improved some internal interfaces. Made a structure for Barrett primes
  245. instead of passing parameters individually. Moved some field operations
  246. to places that make more sense, eg Barrett serialize and deserialize. The
  247. deserialize operation now checks that its argument is in [0,q).
  248. Added more documentation.
  249. Changed the names of a bunch of functions. Still not entirely consistent,
  250. but getting more so.
  251. Some minor speed improvements. For example, multiply is now a couple cycles
  252. faster.
  253. Added a hackish attempt at thread-safety and initialization sanity checking
  254. in the Goldilocks top-level routines.
  255. Fixed some vector alignment bugs. Compiling with -O0 should now work.
  256. Slightly simplified recode_wnaf.
  257. Add a config.h file for future configuration. EXPERIMENT flags moved here.
  258. I've decided against major changes to SHA512 for the moment. They add speed
  259. but also significantly bloat the code, which is going to hurt L1 cache
  260. performance. Perhaps we should link to OpenSSL if a faster SHA512 is desired.
  261. Reorganize the source tree into src, test; factor arch stuff into src/arch_*.
  262. Make most of the code 32-bit clean. There's now a 32-bit generic and 32-bit
  263. vectorless ARM version. No NEON version yet because I don't have a test
  264. machine (could use my phone in a pinch I guess?). The 32-bit version still
  265. isn't heavily optimized, but on ARM it's using a nicely reworked signed/phi-adic
  266. multiplier. The squaring is also based on this, but could really stand some
  267. improvement.
  268. When passed an even exponent (or extra doubles), the Montgomery ladder should
  269. now be accept points if and only if they lie on the curve. This needs
  270. additional testing, but it passes the zero bit exponent test.
  271. On 32-bit, use 8x4x14 instead of 5x5x18 table organization. Probably there's
  272. a better heuristic.
  273. March 5, 2014:
  274. First revision.
  275. Private keys are now longer. They now store a copy of the public key, and
  276. a secret symmetric key for signing purposes.
  277. Signatures are now supported, though like everything else in this library,
  278. their format is not stable. They use a deterministic Schnorr mode,
  279. similar to EdDSA. Precomputed low-latency signing is not supported (yet?).
  280. The hash function is SHA-512.
  281. The deterministic hashing mode needs to be changed to HMAC (TODO!). It's
  282. currently envelope-MAC.
  283. Probably in the future there will be a distinction between ECDH key and
  284. signing keys (and possibly also MQV keys etc).
  285. Began renaming internal functions. Removing p448_ prefixes from EC point
  286. operations. Trying to put the verb first. For example,
  287. "p448_isogeny_un_to_tw" is now called "twist_and_double".
  288. Began documenting with Doxygen. Use "make doc" to make a very incomplete
  289. documentation directory.
  290. There have been many other internal changes.
  291. Feb 21, 2014:
  292. Initial import and benchmarking scripts.
  293. Keygen and ECDH are implemented, but there's no hash function.