From 5c26d791ba611a00af3a6010c014694f6582bf12 Mon Sep 17 00:00:00 2001 From: "Pavel V. Shatov (Meister)" Date: Fri, 6 Apr 2018 21:52:21 +0300 Subject: * Follow more closely what Verilog does * Don't use hardcoded numbers, use the ones built into fastecdsa package * Generate more test vectors to really abuse the core and trigger the rarely used code path in the point addition procedure --- test_vectors/ecdh_test_vectors.v | 91 ++++++++++++++++++++++++++++++------ test_vectors/format_test_vectors.py | 93 ++++++++++++++++++++++++++----------- 2 files changed, 144 insertions(+), 40 deletions(-) (limited to 'test_vectors') diff --git a/test_vectors/ecdh_test_vectors.v b/test_vectors/ecdh_test_vectors.v index 3b2e83e..7a5ef26 100644 --- a/test_vectors/ecdh_test_vectors.v +++ b/test_vectors/ecdh_test_vectors.v @@ -1,5 +1,9 @@ /* Generated automatically, do not edit. */ +localparam [255:0] P_256_N = + {32'hffffffff, 32'h00000000, 32'hffffffff, 32'hffffffff, + 32'hbce6faad, 32'ha7179e84, 32'hf3b9cac2, 32'hfc632551}; + localparam [255:0] P_256_DA = {32'h404d4afa, 32'h3865a3d6, 32'hf921ccb4, 32'h7cdea4e9, 32'h276c3d45, 32'h6e84d196, 32'h63324daf, 32'h8c5e2f44}; @@ -12,17 +16,25 @@ localparam [255:0] P_256_QA_Y = {32'hd1345bcc, 32'ha022ea89, 32'h53b04c2d, 32'h11fc24f8, 32'h0b3b7f84, 32'h7b79deee, 32'hd92ec430, 32'hd8ec3c98}; +localparam [255:0] P_256_QA2_X = + {32'h1aa13502, 32'h273db88f, 32'h21b4b0be, 32'h688a06c6, + 32'h6a6019ef, 32'h7a00eb42, 32'h8e84a4b0, 32'h1dac831a}; + +localparam [255:0] P_256_QA2_Y = + {32'h60b3485e, 32'hf3357265, 32'h37fb2896, 32'h353d09c3, + 32'he6b148bc, 32'h2674f25a, 32'h353be0d1, 32'hc1fd615b}; + localparam [255:0] P_256_DB = {32'h7159a43b, 32'he8322471, 32'h19feaeb2, 32'h7a92466e, 32'h2b07c8df, 32'h29bbd7ea, 32'hd3232af8, 32'h44995a95}; -localparam [255:0] P_256_QB_X = - {32'h0514608d, 32'hc2dc6a21, 32'h74b084d6, 32'h168aad13, - 32'h4acd3f52, 32'h6e49dc32, 32'hbf9872aa, 32'ha4be99d9}; +localparam [255:0] P_256_QB2_X = + {32'h7f1985aa, 32'h9dd4df67, 32'h2e1b8673, 32'ha0a9adf8, + 32'h1f42adde, 32'had136ffb, 32'h0a89b382, 32'hb741238f}; -localparam [255:0] P_256_QB_Y = - {32'h724afa75, 32'h4c672b71, 32'he87c9bda, 32'he1e2b15f, - 32'h784f480f, 32'heb62040e, 32'h281953bd, 32'hea382946}; +localparam [255:0] P_256_QB2_Y = + {32'h7281e72d, 32'h4c2aef64, 32'h048b04d5, 32'hf7d3a824, + 32'h294e3da8, 32'h2ddf43d7, 32'h009a5760, 32'hea0bc5a7}; localparam [255:0] P_256_S_X = {32'ha001c11b, 32'h0d04b6c3, 32'hbe99551e, 32'h9115b811, @@ -32,6 +44,27 @@ localparam [255:0] P_256_S_Y = {32'h14ed5674, 32'h62b6ba27, 32'h2ba0e01b, 32'h2647d725, 32'h5919bf5e, 32'hcbb542f7, 32'h659d40de, 32'h324524ac}; +localparam [255:0] P_256_G_X = + {32'h6b17d1f2, 32'he12c4247, 32'hf8bce6e5, 32'h63a440f2, + 32'h77037d81, 32'h2deb33a0, 32'hf4a13945, 32'hd898c296}; + +localparam [255:0] P_256_G_Y = + {32'h4fe342e2, 32'hfe1a7f9b, 32'h8ee7eb4a, 32'h7c0f9e16, + 32'h2bce3357, 32'h6b315ece, 32'hcbb64068, 32'h37bf51f5}; + +localparam [255:0] P_256_H_X = + {32'h7cf27b18, 32'h8d034f7e, 32'h8a523803, 32'h04b51ac3, + 32'hc08969e2, 32'h77f21b35, 32'ha60b48fc, 32'h47669978}; + +localparam [255:0] P_256_H_Y = + {32'h07775510, 32'hdb8ed040, 32'h293d9ac6, 32'h9f7430db, + 32'hba7dade6, 32'h3ce98229, 32'h9e04b79d, 32'h227873d1}; + +localparam [383:0] P_384_N = + {32'hffffffff, 32'hffffffff, 32'hffffffff, 32'hffffffff, + 32'hffffffff, 32'hffffffff, 32'hc7634d81, 32'hf4372ddf, + 32'h581a0db2, 32'h48b0a77a, 32'hecec196a, 32'hccc52973}; + localparam [383:0] P_384_DA = {32'he733d9db, 32'hb8867b57, 32'h3cbbc0bd, 32'h899c88db, 32'h669322e8, 32'h0435c1a4, 32'he2b0ddb1, 32'h5e757371, @@ -47,20 +80,30 @@ localparam [383:0] P_384_QA_Y = 32'h8ee6a89a, 32'haeccd8fb, 32'h61b35364, 32'hc70dfb48, 32'heb5c685c, 32'h810bd9cb, 32'h2d184fb1, 32'h096ab30f}; +localparam [383:0] P_384_QA2_X = + {32'ha7b06d0d, 32'hb185275b, 32'he0a76c9f, 32'h0d7e1037, + 32'hb1b993a6, 32'hb055426c, 32'h82d1c569, 32'hab12f11f, + 32'h78c9b620, 32'heeca809d, 32'hfe7f31ed, 32'hcef06af5}; + +localparam [383:0] P_384_QA2_Y = + {32'h1cfa89ed, 32'h774860c8, 32'h1ee725b0, 32'h9773be94, + 32'h58c4e140, 32'h8caa4964, 32'hd0044b57, 32'h92f5e0c9, + 32'h8fa62798, 32'h86c1bcbc, 32'h67ab059a, 32'hc38a59a1}; + localparam [383:0] P_384_DB = {32'h5601820d, 32'h705224a5, 32'hdd6ddb13, 32'he0a15e76, 32'h869e6abe, 32'h37ba2235, 32'h792af9f6, 32'ha9bf114a, 32'hd1fd319d, 32'hd8181e06, 32'h44f15448, 32'h4e73a75a}; -localparam [383:0] P_384_QB_X = - {32'h37ab556d, 32'h0652c6b9, 32'he352c643, 32'h4502be19, - 32'h9fb9c50f, 32'h2ade049b, 32'h06e50c30, 32'hcdab0673, - 32'h69efe0c0, 32'h6e114a76, 32'hf1338175, 32'hdb4f4982}; +localparam [383:0] P_384_QB2_X = + {32'hdf3317b1, 32'hba767101, 32'h33c69cd8, 32'hc70de5b6, + 32'h68b78d56, 32'hf0d851ec, 32'hf1697b04, 32'hd2ade0e8, + 32'h30a6e6d6, 32'h2467d70d, 32'hbe12e265, 32'haccdd5ed}; -localparam [383:0] P_384_QB_Y = - {32'h21cddae0, 32'hf117b656, 32'h7c9d477b, 32'hc1fc5d24, - 32'h3b26651e, 32'h1406f1ee, 32'hb3418552, 32'h739c9395, - 32'h6774c84d, 32'h20cedc15, 32'h92fd5de0, 32'h4bbf98ad}; +localparam [383:0] P_384_QB2_Y = + {32'h6d8c1907, 32'ha63f3e87, 32'hd186f8b5, 32'h06fcf6d9, + 32'h2cc2a8a7, 32'hd38fa0ee, 32'hd9b67320, 32'h7181bcf4, + 32'h408e0dd0, 32'h25dfee03, 32'h6916632a, 32'h8335fba2}; localparam [383:0] P_384_S_X = {32'h15ac62cb, 32'hbb51e1ed, 32'hd41d489f, 32'hdfa05d45, @@ -72,3 +115,23 @@ localparam [383:0] P_384_S_Y = 32'hf62be0a3, 32'h73da36ef, 32'h8992e7c9, 32'h6cf7619d, 32'ha2d6c0a2, 32'hd31ad05d, 32'hb3a16a95, 32'h0cb7055f}; +localparam [383:0] P_384_G_X = + {32'haa87ca22, 32'hbe8b0537, 32'h8eb1c71e, 32'hf320ad74, + 32'h6e1d3b62, 32'h8ba79b98, 32'h59f741e0, 32'h82542a38, + 32'h5502f25d, 32'hbf55296c, 32'h3a545e38, 32'h72760ab7}; + +localparam [383:0] P_384_G_Y = + {32'h3617de4a, 32'h96262c6f, 32'h5d9e98bf, 32'h9292dc29, + 32'hf8f41dbd, 32'h289a147c, 32'he9da3113, 32'hb5f0b8c0, + 32'h0a60b1ce, 32'h1d7e819d, 32'h7a431d7c, 32'h90ea0e5f}; + +localparam [383:0] P_384_H_X = + {32'h08d99905, 32'h7ba3d2d9, 32'h69260045, 32'hc55b97f0, + 32'h89025959, 32'ha6f434d6, 32'h51d207d1, 32'h9fb96e9e, + 32'h4fe0e86e, 32'hbe0e64f8, 32'h5b96a9c7, 32'h5295df61}; + +localparam [383:0] P_384_H_Y = + {32'h8e80f1fa, 32'h5b1b3ced, 32'hb7bfe8df, 32'hfd6dba74, + 32'hb275d875, 32'hbc6cc43e, 32'h904e505f, 32'h256ab425, + 32'h5ffd43e9, 32'h4d39e22d, 32'h61501e70, 32'h0a940e80}; + diff --git a/test_vectors/format_test_vectors.py b/test_vectors/format_test_vectors.py index 57f2de1..2d4744a 100644 --- a/test_vectors/format_test_vectors.py +++ b/test_vectors/format_test_vectors.py @@ -44,8 +44,8 @@ # import sys import subprocess -from fastecdsa.curve import P256 -from fastecdsa.curve import P384 +from fastecdsa import keys, curve +from fastecdsa.curve import P256, P384 from fastecdsa.point import Point # list of curve names of interest @@ -53,12 +53,10 @@ CURVE_P256 = "p256" CURVE_P384 = "p384" # the base point for p-256 -P256_GX = 0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296 -P256_GY = 0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5 +P256_BASE = keys.get_public_key(1, curve.P256) # the base point for p-384 -P384_GX = 0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7 -P384_GY = 0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f +P384_BASE = keys.get_public_key(1, curve.P384) # # format one test vector @@ -83,7 +81,14 @@ def format_c_header(f, curve, da, qax, qay, db, qbx, qby, sx, sy): # # format one test vector # -def format_verilog_include(f, curve, da, qax, qay, db, qbx, qby, sx, sy): +def format_verilog_include( f, curve, n, + da, qax, qay, + db, qbx, qby, + sx, sy, + gx, gy, + hx, hy, + qa2x, qa2y, + qb2x, qb2y): if curve == CURVE_P256: curve_str = "P_256" @@ -94,16 +99,26 @@ def format_verilog_include(f, curve, da, qax, qay, db, qbx, qby, sx, sy): msb_index = "383" # write all numbers in vector - format_verilog_concatenation(f, da, "localparam [" + msb_index + ":0] " + curve_str + "_DA" + " =\n") - format_verilog_concatenation(f, qax, "localparam [" + msb_index + ":0] " + curve_str + "_QA_X" + " =\n") - format_verilog_concatenation(f, qay, "localparam [" + msb_index + ":0] " + curve_str + "_QA_Y" + " =\n") + format_verilog_concatenation(f, n, "localparam [" + msb_index + ":0] " + curve_str + "_N" + " =\n") - format_verilog_concatenation(f, db, "localparam [" + msb_index + ":0] " + curve_str + "_DB" + " =\n") - format_verilog_concatenation(f, qbx, "localparam [" + msb_index + ":0] " + curve_str + "_QB_X" + " =\n") - format_verilog_concatenation(f, qby, "localparam [" + msb_index + ":0] " + curve_str + "_QB_Y" + " =\n") + format_verilog_concatenation(f, da, "localparam [" + msb_index + ":0] " + curve_str + "_DA" + " =\n") + format_verilog_concatenation(f, qax, "localparam [" + msb_index + ":0] " + curve_str + "_QA_X" + " =\n") + format_verilog_concatenation(f, qay, "localparam [" + msb_index + ":0] " + curve_str + "_QA_Y" + " =\n") + format_verilog_concatenation(f, qa2x, "localparam [" + msb_index + ":0] " + curve_str + "_QA2_X" + " =\n") + format_verilog_concatenation(f, qa2y, "localparam [" + msb_index + ":0] " + curve_str + "_QA2_Y" + " =\n") - format_verilog_concatenation(f, sx, "localparam [" + msb_index + ":0] " + curve_str + "_S_X" + " =\n") - format_verilog_concatenation(f, sy, "localparam [" + msb_index + ":0] " + curve_str + "_S_Y" + " =\n") + format_verilog_concatenation(f, db, "localparam [" + msb_index + ":0] " + curve_str + "_DB" + " =\n") + format_verilog_concatenation(f, qb2x, "localparam [" + msb_index + ":0] " + curve_str + "_QB2_X" + " =\n") + format_verilog_concatenation(f, qb2y, "localparam [" + msb_index + ":0] " + curve_str + "_QB2_Y" + " =\n") + + format_verilog_concatenation(f, sx, "localparam [" + msb_index + ":0] " + curve_str + "_S_X" + " =\n") + format_verilog_concatenation(f, sy, "localparam [" + msb_index + ":0] " + curve_str + "_S_Y" + " =\n") + + format_verilog_concatenation(f, gx, "localparam [" + msb_index + ":0] " + curve_str + "_G_X" + " =\n") + format_verilog_concatenation(f, gy, "localparam [" + msb_index + ":0] " + curve_str + "_G_Y" + " =\n") + + format_verilog_concatenation(f, hx, "localparam [" + msb_index + ":0] " + curve_str + "_H_X" + " =\n") + format_verilog_concatenation(f, hy, "localparam [" + msb_index + ":0] " + curve_str + "_H_Y" + " =\n") # # nicely format multi-word integer into C array initializer @@ -283,11 +298,11 @@ def get_key(party, curve): # another sanity check (make sure, that Q is actually d * G) if curve == CURVE_P256: - G = Point(P256_GX, P256_GY, curve=P256) + G = P256_BASE Q = Point(key_pub_x, key_pub_y, curve=P256) if curve == CURVE_P384: - G = Point(P384_GX, P384_GY, curve=P384) + G = P384_BASE Q = Point(key_pub_x, key_pub_y, curve=P384) # multiply using fastecdsa @@ -314,19 +329,34 @@ if __name__ == "__main__": file_v.write("/* Generated automatically, do not edit. */\n\n") # process all the keys - for curve in curves: + for next_curve in curves: # load keys - da, qax, qay = get_key("alice", curve) - db, qbx, qby = get_key("bob", curve) + da, qax, qay = get_key("alice", next_curve) + db, qbx, qby = get_key("bob", next_curve) # Alice's public key - if (curve == CURVE_P256): QA = Point(qax, qay, curve=P256) - if (curve == CURVE_P384): QA = Point(qax, qay, curve=P384) + if (next_curve == CURVE_P256): QA = Point(qax, qay, curve=P256) + if (next_curve == CURVE_P384): QA = Point(qax, qay, curve=P384) # Bob's public key - if (curve == CURVE_P256): QB = Point(qbx, qby, curve=P256) - if (curve == CURVE_P384): QB = Point(qbx, qby, curve=P384) + if (next_curve == CURVE_P256): QB = Point(qbx, qby, curve=P256) + if (next_curve == CURVE_P384): QB = Point(qbx, qby, curve=P384) + + # the base point + if (next_curve == CURVE_P256): G = P256_BASE + if (next_curve == CURVE_P384): G = P384_BASE + + # double of the base point + H = 2 * G + + # doubles of QA and QB + QA2 = 2 * QA + QB2 = 2 * QB + + # order of the base point + if (next_curve == CURVE_P256): n = curve.P256.q + if (next_curve == CURVE_P384): n = curve.P384.q # we derive the shared secret two different ways (from Alice's and # from Bob's perspective, they must be identical of course @@ -339,8 +369,19 @@ if __name__ == "__main__": print("Derived shared secret."); # format numbers and write to file - format_c_header(file_h, curve, da, qax, qay, db, qbx, qby, QAB.x, QBA.y) - format_verilog_include(file_v, curve, da, qax, qay, db, qbx, qby, QAB.x, QBA.y) + format_c_header( file_h, next_curve, + da, qax, qay, + db, qbx, qby, + QAB.x, QBA.y) + + format_verilog_include( file_v, next_curve, n, + da, qax, qay, + db, qbx, qby, + QAB.x, QBA.y, + G.x, G.y, + H.x, H.y, + QA2.x, QA2.y, + QB2.x, QB2.y) # done file_h.close() -- cgit v1.2.3