ecc/25519/sp: octet-correct X25519/Ed25519 and SP byte<->mp conversion for CHAR_BIT != 8

Author: dgarske

wolfcrypt/src/fe_operations.c

@@ -525,6 +525,9 @@ void fe_tobytes(unsigned char *s,const fe h)
   sword32 carry7;
   sword32 carry8;
   sword32 carry9;
+#ifdef WOLFSSL_WIDE_BYTE
+  int i;
+#endif
 
   q = (19 * h9 + (sword32)(((word32) 1) << 24)) >> 25;
   q = (h0 + q) >> 26;
@@ -593,6 +596,12 @@ void fe_tobytes(unsigned char *s,const fe h)
   s[29] = (byte)(h9 >> 2);
   s[30] = (byte)(h9 >> 10);
   s[31] = (byte)(h9 >> 18);
+#ifdef WOLFSSL_WIDE_BYTE
+  /* CHAR_BIT != 8: a (byte) cast does not truncate to an octet, so mask each
+   * output cell to its low 8 bits (the intended octet computed above). */
+  for (i = 0; i < 32; i++)
+    s[i] = WC_OCTET(s[i]);
+#endif
 }
 
 

wolfcrypt/src/ge_operations.c

@@ -109,6 +109,9 @@ void sc_reduce(byte* s)
 {
     sword64 t[24];
     sword64 carry;
+#ifdef WOLFSSL_WIDE_BYTE
+    int i;
+#endif
 
     t[ 0] = MASK_21 & (load_3(s +  0) >> 0);
     t[ 1] = MASK_21 & (load_4(s +  2) >> 5);
@@ -296,6 +299,12 @@ void sc_reduce(byte* s)
     s[29] = (byte)(t[11] >>  1);
     s[30] = (byte)(t[11] >>  9);
     s[31] = (byte)(t[11] >> 17);
+#ifdef WOLFSSL_WIDE_BYTE
+    /* CHAR_BIT != 8: a (byte) cast does not truncate to an octet, so mask each
+     * output cell to its low 8 bits (the intended octet computed above). */
+    for (i = 0; i < 32; i++)
+        s[i] = WC_OCTET(s[i]);
+#endif
 }
 
 /*
@@ -313,6 +322,9 @@ void sc_muladd(byte* s, const byte* a, const byte* b, const byte* c)
     word32 ad[12], bd[12], cd[12];
     sword64 t[24];
     sword64 carry;
+#ifdef WOLFSSL_WIDE_BYTE
+    int i;
+#endif
 
     ad[ 0] = MASK_21 & (load_3(a +  0) >> 0);
     ad[ 1] = MASK_21 & (load_4(a +  2) >> 5);
@@ -616,6 +628,12 @@ void sc_muladd(byte* s, const byte* a, const byte* b, const byte* c)
     s[29] = (byte)(t[11] >>  1);
     s[30] = (byte)(t[11] >>  9);
     s[31] = (byte)(t[11] >> 17);
+#ifdef WOLFSSL_WIDE_BYTE
+    /* CHAR_BIT != 8: a (byte) cast does not truncate to an octet, so mask each
+     * output cell to its low 8 bits (the intended octet computed above). */
+    for (i = 0; i < 32; i++)
+        s[i] = WC_OCTET(s[i]);
+#endif
 }
 #endif
 #else
@@ -974,7 +992,10 @@ static unsigned char equal(unsigned char b,unsigned char c)
 
 static unsigned char negative(signed char b)
 {
-  return ((unsigned char)b) >> 7;
+  /* Want bit 7 (the 8-bit sign bit) as 0/1.  An (unsigned char) cast does not
+   * truncate to 8 bits where a byte is wider than an octet (C28x), so mask to
+   * an octet first; WC_OCTET is a no-op on 8-bit targets. */
+  return (unsigned char)(WC_OCTET(b) >> 7);
 }
 
 static WC_INLINE void cmov(ge_precomp *t,const ge_precomp *u,unsigned char b,

wolfcrypt/src/sp_c32.c

@@ -380,13 +380,13 @@ static void sp_2048_to_bin_72(sp_digit* r, byte* a)
     for (i=0; i<71 && j>=0; i++) {
         b = 0;
         /* lint allow cast of mismatch sp_digit and int */
-        a[j--] |= (byte)((sp_uint32)r[i] << s); /*lint !e9033*/
+        a[j--] |= (byte)(((sp_uint32)r[i] << s) & 0xFF); /*lint !e9033*/
         b += 8 - s;
         if (j < 0) {
             break;
         }
         while (b < 29) {
-            a[j--] = (byte)(r[i] >> b);
+            a[j--] = (byte)((r[i] >> b) & 0xFF);
             b += 8;
             if (j < 0) {
                 break;
@@ -5313,13 +5313,13 @@ static void sp_3072_to_bin_106(sp_digit* r, byte* a)
     for (i=0; i<106 && j>=0; i++) {
         b = 0;
         /* lint allow cast of mismatch sp_digit and int */
-        a[j--] |= (byte)((sp_uint32)r[i] << s); /*lint !e9033*/
+        a[j--] |= (byte)(((sp_uint32)r[i] << s) & 0xFF); /*lint !e9033*/
         b += 8 - s;
         if (j < 0) {
             break;
         }
         while (b < 29) {
-            a[j--] = (byte)(r[i] >> b);
+            a[j--] = (byte)((r[i] >> b) & 0xFF);
             b += 8;
             if (j < 0) {
                 break;
@@ -12915,13 +12915,13 @@ static void sp_4096_to_bin_142(sp_digit* r, byte* a)
     for (i=0; i<142 && j>=0; i++) {
         b = 0;
         /* lint allow cast of mismatch sp_digit and int */
-        a[j--] |= (byte)((sp_uint32)r[i] << s); /*lint !e9033*/
+        a[j--] |= (byte)(((sp_uint32)r[i] << s) & 0xFF); /*lint !e9033*/
         b += 8 - s;
         if (j < 0) {
             break;
         }
         while (b < 29) {
-            a[j--] = (byte)(r[i] >> b);
+            a[j--] = (byte)((r[i] >> b) & 0xFF);
             b += 8;
             if (j < 0) {
                 break;
@@ -25240,13 +25240,13 @@ static void sp_256_to_bin_9(sp_digit* r, byte* a)
     for (i=0; i<9 && j>=0; i++) {
         b = 0;
         /* lint allow cast of mismatch sp_digit and int */
-        a[j--] |= (byte)((sp_uint32)r[i] << s); /*lint !e9033*/
+        a[j--] |= (byte)(((sp_uint32)r[i] << s) & 0xFF); /*lint !e9033*/
         b += 8 - s;
         if (j < 0) {
             break;
         }
         while (b < 29) {
-            a[j--] = (byte)(r[i] >> b);
+            a[j--] = (byte)((r[i] >> b) & 0xFF);
             b += 8;
             if (j < 0) {
                 break;

wolfcrypt/src/sp_int.c

@@ -18313,7 +18313,9 @@ int sp_read_unsigned_bin(sp_int* a, const byte* in, word32 inSz)
 #if SP_WORD_SIZE >= 16
         /* Handle leftovers. */
         if (i >= 0) {
-    #ifdef BIG_ENDIAN_ORDER
+    #if defined(BIG_ENDIAN_ORDER) || defined(WOLFSSL_WIDE_BYTE)
+            /* Shift-based packing; CHAR_BIT-agnostic, unlike the byte-aliasing
+             * path below (which assumes one octet per cell - wrong on C28x). */
             int s;
 
             /* Place remaining bytes into last digit. */

wolfssl/wolfcrypt/settings.h

@@ -5157,7 +5157,10 @@ blinding by defining WC_BLINDING_NO_RNG_ACKNOWLEDGE_WEAKNESS."
            " with static memory (WOLFSSL_STATIC_MEMORY)"
 #endif
 #if defined(WC_16BIT_CPU) && \
-    (defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL))
+    (defined(WOLFSSL_SP_MATH) || defined(WOLFSSL_SP_MATH_ALL)) && \
+    !defined(WOLFSSL_SP_ALLOW_16BIT_CPU)
+    /* SP math works on a 16-bit-int CPU with SP_WORD_SIZE >= 32 (validated on
+     * TI C28x); opt past this guard with WOLFSSL_SP_ALLOW_16BIT_CPU. */
     #error "16-bit build (WC_16BIT_CPU) is not available with SP math"
 #endif
 

wolfssl/wolfcrypt/sp_int.h

@@ -58,8 +58,17 @@ extern "C" {
 
     typedef unsigned char sp_uint7;
     typedef          char  sp_int7;
+#elif UCHAR_MAX == 65535
+    /* CHAR_BIT == 16 (e.g. TI C28x): the smallest addressable type is 16-bit,
+     * so there is no native 8-bit type.  An "8-bit" SP value is a 16-bit char
+     * cell holding an octet (0..255); byte I/O masks to an octet (the same
+     * CHAR_BIT!=8 handling used elsewhere - see WOLFSSL_WIDE_BYTE). */
+    #define SP_UCHAR_BITS    16
+
+    typedef unsigned char sp_uint8;
+    typedef          char  sp_int8;
 #else
-    #error "Size of unsigned short not detected"
+    #error "Size of unsigned char not detected"
 #endif
 
 #if USHRT_MAX == 65535