[crypto/25519] Propagate the masking in x25519

Propagate the masking of the keys in x25519 to the OTBN and use the
masked scalar multiplication from ed25519.
Change the sc_blind subroutine to blind with a clamped blinding factor
(adding 3 bits to the size).

Use the s2b and b2a from p256.
Note that due to the sharing change (additive versus substraction) we
switch the masking by adding a new mask B.

Signed-off-by: Siemen Dhooghe <sdhooghe@google.com>

Author: siemen11

sw/device/lib/crypto/impl/ecc/curve25519.c

@@ -39,8 +39,6 @@ OTBN_DECLARE_SYMBOL_ADDR(run_curve25519,
                          ed25519_r0);  // 640-bit first share of r.
 OTBN_DECLARE_SYMBOL_ADDR(run_curve25519,
                          ed25519_r1);  // 640-bit second share of r.
-OTBN_DECLARE_SYMBOL_ADDR(run_curve25519,
-                         x25519_private_key);  // X25519 private key.
 OTBN_DECLARE_SYMBOL_ADDR(run_curve25519,
                          x25519_public_key);  // X25519 public key.
 OTBN_DECLARE_SYMBOL_ADDR(run_curve25519,
@@ -62,8 +60,8 @@ enum {
   /*
    * The expected instruction counts for constant time functions.
    */
-  kModeKeygenInsCnt = 339495,
-  kModeSignStage1InsCnt = 679051,
+  kModeKeygenInsCnt = 342109,
+  kModeSignStage1InsCnt = 684279,
   kModeSignStage2InsCnt = 655,
 };
 
@@ -299,7 +297,8 @@ status_t curve25519_verify_finalize(hardened_bool_t *result) {
 }
 
 status_t curve25519_x25519_start(
-    const uint32_t private_key[kCurve25519ScalarWords],
+    const uint32_t s0[kCurve25519ScalarWords],
+    const uint32_t s1[kCurve25519ScalarWords],
     const uint32_t public_key[kCurve25519PointWords]) {
   // Load the Curve25519 app. Fails if OTBN is non-idle.
   const otbn_app_t kOtbnAppCurve25519 = OTBN_APP_T_INIT(run_curve25519);
@@ -310,11 +309,11 @@ status_t curve25519_x25519_start(
   const otbn_addr_t kOtbnVarMode = OTBN_ADDR_T_INIT(run_curve25519, mode);
   HARDENED_TRY(otbn_dmem_write(kCurve25519ModeWords, &mode, kOtbnVarMode));
 
-  // Write the private key to DMEM.
-  const otbn_addr_t kOtbnVarX25519PrivateKey =
-      OTBN_ADDR_T_INIT(run_curve25519, x25519_private_key);
-  HARDENED_TRY(otbn_dmem_write(kCurve25519ScalarWords, private_key,
-                               kOtbnVarX25519PrivateKey));
+  // Write the private key arithmetic shares to DMEM.
+  const otbn_addr_t kOtbnVarS0 = OTBN_ADDR_T_INIT(run_curve25519, ed25519_s0);
+  const otbn_addr_t kOtbnVarS1 = OTBN_ADDR_T_INIT(run_curve25519, ed25519_s1);
+  HARDENED_TRY(otbn_dmem_write(kCurve25519ScalarWords, s0, kOtbnVarS0));
+  HARDENED_TRY(otbn_dmem_write(kCurve25519ScalarWords, s1, kOtbnVarS1));
 
   // Write the public key to DMEM.
   const otbn_addr_t kOtbnVarX25519PublicKey =
@@ -386,7 +385,8 @@ status_t curve25519_x25519_finalize(
 }
 
 status_t curve25519_x25519_keygen_start(
-    const uint32_t private_key[kCurve25519ScalarWords]) {
+    const uint32_t s0[kCurve25519ScalarWords],
+    const uint32_t s1[kCurve25519ScalarWords]) {
   // Load the Curve25519 app. Fails if OTBN is non-idle.
   const otbn_app_t kOtbnAppCurve25519 = OTBN_APP_T_INIT(run_curve25519);
   HARDENED_TRY(otbn_load_app(kOtbnAppCurve25519));
@@ -396,11 +396,11 @@ status_t curve25519_x25519_keygen_start(
   const otbn_addr_t kOtbnVarMode = OTBN_ADDR_T_INIT(run_curve25519, mode);
   HARDENED_TRY(otbn_dmem_write(kCurve25519ModeWords, &mode, kOtbnVarMode));
 
-  // Write the private key to DMEM.
-  const otbn_addr_t kOtbnVarX25519PrivateKey =
-      OTBN_ADDR_T_INIT(run_curve25519, x25519_private_key);
-  HARDENED_TRY(otbn_dmem_write(kCurve25519ScalarWords, private_key,
-                               kOtbnVarX25519PrivateKey));
+  // Write the private key arithmetic shares to DMEM.
+  const otbn_addr_t kOtbnVarS0 = OTBN_ADDR_T_INIT(run_curve25519, ed25519_s0);
+  const otbn_addr_t kOtbnVarS1 = OTBN_ADDR_T_INIT(run_curve25519, ed25519_s1);
+  HARDENED_TRY(otbn_dmem_write(kCurve25519ScalarWords, s0, kOtbnVarS0));
+  HARDENED_TRY(otbn_dmem_write(kCurve25519ScalarWords, s1, kOtbnVarS1));
 
   // Start the OTBN routine.
   return otbn_execute();

sw/device/lib/crypto/impl/ecc/curve25519.h

@@ -277,13 +277,15 @@ status_t curve25519_verify_finalize(hardened_bool_t *result);
  *
  * Returns an `OTCRYPTO_ASYNC_INCOMPLETE` error if OTBN is busy.
  *
- * @param private_key The unmasked private key.
+ * @param s0 The first arithmetic share of the masked private key.
+ * @param s1 The second arithmetic share of the masked private key.
  * @param public_key The public key from the other party.
  * @return Result of the operation (OK or error).
  */
 OT_WARN_UNUSED_RESULT
 status_t curve25519_x25519_start(
-    const uint32_t private_key[kCurve25519ScalarWords],
+    const uint32_t s0[kCurve25519ScalarWords],
+    const uint32_t s1[kCurve25519ScalarWords],
     const uint32_t public_key[kCurve25519PointWords]);
 
 /**
@@ -324,12 +326,14 @@ status_t curve25519_x25519_finalize(
  *
  * Returns an `OTCRYPTO_ASYNC_INCOMPLETE` error if OTBN is busy.
  *
- * @param private_key The unmasked private key.
+ * @param s0 The first arithmetic share of the masked private key.
+ * @param s1 The second arithmetic share of the masked private key.
  * @return Result of the operation (OK or error).
  */
 OT_WARN_UNUSED_RESULT
 status_t curve25519_x25519_keygen_start(
-    const uint32_t private_key[kCurve25519ScalarWords]);
+    const uint32_t s0[kCurve25519ScalarWords],
+    const uint32_t s1[kCurve25519ScalarWords]);
 
 /**
  * Finish an async X25519 keygen operation on OTBN.

sw/device/lib/crypto/impl/ecc_curve25519.c

@@ -729,22 +729,13 @@ otcrypto_status_t otcrypto_x25519_keygen_async_start(
 
     return otcrypto_eval_exit(curve25519_x25519_keygen_sideload_start());
   } else if (private_key->config.hw_backed == kHardenedBoolFalse) {
-    uint32_t private_key_unmasked[kCurve25519ScalarWords];
     uint32_t *share0 = private_key->keyblob;
     uint32_t *share1 =
         private_key->keyblob + keyblob_share_num_words(private_key->config);
 
-    HARDENED_TRY(hardened_add(share0, share1, kCurve25519ScalarWords,
-                              private_key_unmasked));
+    HARDENED_TRY(curve25519_x25519_keygen_start(share0, share1));
 
-    HARDENED_TRY(ed25519_clamp(private_key_unmasked));
-
-    // Start the OTBN key exchange app.
-    HARDENED_TRY(curve25519_x25519_keygen_start(private_key_unmasked));
-
-    // Wipe the unmasked private key.
-    return otcrypto_eval_exit(
-        hardened_memshred(private_key_unmasked, kCurve25519ScalarWords));
+    return otcrypto_eval_exit(OTCRYPTO_OK);
   }
 
   return OTCRYPTO_BAD_ARGS;
@@ -777,23 +768,13 @@ otcrypto_status_t otcrypto_x25519_async_start(
         curve25519_x25519_sideload_start(public_key->key));
 
   } else if (private_key->config.hw_backed == kHardenedBoolFalse) {
-    uint32_t private_key_unmasked[kCurve25519ScalarWords];
-
-    // Unmask the private key
     uint32_t *share0 = private_key->keyblob;
     uint32_t *share1 =
         private_key->keyblob + keyblob_share_num_words(private_key->config);
-    HARDENED_TRY(hardened_add(share0, share1, kCurve25519ScalarWords,
-                              private_key_unmasked));
-    HARDENED_TRY(ed25519_clamp(private_key_unmasked));
 
-    // Start the standard OTBN key exchange app
-    HARDENED_TRY(
-        curve25519_x25519_start(private_key_unmasked, public_key->key));
+    HARDENED_TRY(curve25519_x25519_start(share0, share1, public_key->key));
 
-    // Wipe the unmasked private key from CPU memory and return
-    return otcrypto_eval_exit(
-        hardened_memshred(private_key_unmasked, kCurve25519ScalarWords));
+    return otcrypto_eval_exit(OTCRYPTO_OK);
   }
 
   return OTCRYPTO_BAD_ARGS;

sw/otbn/crypto/25519.s

@@ -1320,18 +1320,20 @@ ext_scmul_sca:
   bn.mov w4, w16
   bn.mov w5, w17
 
-  /* Move the blinded 382-bit share s0 to the MSB position. */
-  bn.rshi w3, w3, w2 >> 126
-  bn.rshi w2, w2, w31 >> 126
+  /* Move the newly expanded 385-bit share s0 to the MSB position.
+     Left-shift by 127 bits = rshi by 129. */
+  bn.rshi w3, w3, w2 >> 129
+  bn.rshi w2, w2, w31 >> 129
 
   bn.xor w31, w31, w31 /* dummy */
 
-  /* Move the blinded 382-bit share s1 to the MSB position. */
-  bn.rshi w5, w5, w4 >> 126
-  bn.rshi w4, w4, w31 >> 126
+  /* Move the newly expanded 385-bit share s1 to the MSB position. */
+  bn.rshi w5, w5, w4 >> 129
+  bn.rshi w4, w4, w31 >> 129
+
 
   /* Iterate over all scalar bits starting at the MSB. */
-  loopi  382, 56
+  loopi  385, 56
     /* Compute Q = 2 * Q.
          [w13:w10] <= [w13:w10] + [w13:w10] = 2 * Q  */
     jal x1, ext_double
@@ -2033,9 +2035,6 @@ x25519_ed_y_to_mont_u:
  * clobbered flag groups: FG0
  */
 X25519:
-  /* Move the private key scalar */
-  bn.mov   w2, w8
-
   /* Initialize field arithmetic (MOD <= p, w19 <= 19) */
   jal      x1, fe_init
   bn.xor   w31, w31, w31
@@ -2076,11 +2075,8 @@ X25519:
   /* Double w29 so it equals (2*d) mod p */
   bn.addm  w29, w29, w29
 
-  /* Move scalar from w2 to w28 for ext_scmul */
-  bn.mov   w28, w2
-
-  /* Perform scalar multiplication: [w13:w10] = w28 * [w9:w6] */
-  jal      x1, ext_scmul
+  /* Perform masked scalar multiplication: [w13:w10] = (w2 - w4) * [w9:w6] */
+  jal      x1, ext_scmul_sca
 
   /* Convert result back to affine (x, y) */
   jal      x1, ext_to_affine

sw/otbn/crypto/25519_scalar.s

@@ -331,10 +331,10 @@ sc_mul:
  * Blind a scalar with a multiple of the curve order L.
  *
  * Given a scalar s < L, this routine adds a random multiple of the group order
- * k * L to the scalar such that s + k * L. In accordance, with Schindler's and
- * Wiemers' recommendation [1] the blinding factor k is 128 bits. Since the
+ * 8 * k * L to the scalar such that s + 8 * k * L. We left shift k * L (multiply by 8) in order to clamp the blinding factor.
+ * In accordance, with Schindler's and Wiemers' recommendation [1] the blinding factor k is 128 bits. Since the
  * curve order L is 253 bits, by choosing a 128-bit factor k we can guarantee
- * that the blinded scalar s + k * L is at most 382 bits.
+ * that the blinded scalar s + 8 * k * L is at most 385 bits.
  *
  * [1] https://csrc.nist.gov/csrc/media/events/workshop-on-elliptic-curve-cryptography-standards/documents/papers/session6-schindler-werner.pdf
  *
@@ -358,7 +358,7 @@ sc_blind:
 
   /* Calculate k * L, i.e., 128-bit x 253-bit multiplication resulting in a
      381-bit value.
-       [w17:w16] <= [w23:w22] * w21 = k * L. */
+       [w17:w16] <= w22 * w21 = k * L. */
   bn.mulqacc.z          w21.0, w22.0, 0
   bn.mulqacc            w21.0, w22.1, 64
   bn.mulqacc.so  w16.L, w21.1, w22.0, 64
@@ -368,6 +368,12 @@ sc_blind:
   bn.mulqacc.so  w16.U, w21.3, w22.0, 64
   bn.mulqacc.wo  w17,   w21.3, w22.1, 0
 
+  /* w17 = (w17 << 3) | (w16 >> 253) */
+  bn.rshi w17, w17, w16 >> 253
+
+  /* w16 = (w16 << 3) | (0 >> 253) */
+  bn.rshi w16, w16, w31 >> 253
+
   /* Add the 381-bit blinding value to the 253-bit scalar resulting in a
      382-bit blinded scalar avoiding any overflow.
        [w17:w16] <= [w17:w16] + w20 = k * L + s. */
@@ -403,6 +409,9 @@ x25519_clamp_shares:
   /* Shift right 2: inserts the 1 at bit 254, original bit 253 moves back to 253 */
   bn.rshi  w8, w2, w8 >> 2
 
+  /* Clear flags */
+  bn.xor w31, w31, w31
+
   /* --- Clamp Share 1 (w7) --- */
   /* Clear bottom 3 bits */
   bn.rshi  w7, w31, w7 >> 3
@@ -411,6 +420,9 @@ x25519_clamp_shares:
   /* Prepare bit 254 = 0 (use w31 instead of w2) */
   bn.rshi  w7, w31, w7 >> 2
 
+  /* Clear flags before exit */
+  bn.sub  w31, w31, w31, FG0
+
   ret
 
 .data

sw/otbn/crypto/BUILD

@@ -63,6 +63,8 @@ otbn_binary(
         ":25519",
         ":25519_scalar",
         ":field25519",
+        ":p256_a2b",
+        ":p256_b2a",
     ],
 )