diff options
| author | Yawning Angel <yawning@schwanenlied.me> | 2023-04-08 09:57:47 +0900 |
|---|---|---|
| committer | Yawning Angel <yawning@schwanenlied.me> | 2023-04-08 09:57:47 +0900 |
| commit | d72db2698bdb7b976bfdee075088d6ec697dafd9 (patch) | |
| tree | c4168c8bf439b0d8ff9eeac89992894f5d0a72e6 | |
| parent | f863264af6ef1546d3965a8bf865e14c01146054 (diff) | |
core/crypto/_fiat: Hedge against LLVM cleverness
Recent LLVM is getting smart to the point where the optimizer can change
a traditional constant-time conditional swap into a pointer swap.
Ensure that this does not happen by force-disabling optimization.
Additionally, disable inlining the relevant routines such that manual
inspection in optimized builds is still reasonably easy to do.
| -rw-r--r-- | core/crypto/_fiat/fiat.odin | 6 | ||||
| -rw-r--r-- | core/crypto/_fiat/field_curve25519/field51.odin | 6 | ||||
| -rw-r--r-- | core/crypto/_fiat/field_poly1305/field4344.odin | 6 |
3 files changed, 12 insertions, 6 deletions
diff --git a/core/crypto/_fiat/fiat.odin b/core/crypto/_fiat/fiat.odin index ae9727149..f0551722f 100644 --- a/core/crypto/_fiat/fiat.odin +++ b/core/crypto/_fiat/fiat.odin @@ -9,14 +9,16 @@ package fiat u1 :: distinct u8 i1 :: distinct i8 -cmovznz_u64 :: #force_inline proc "contextless" (arg1: u1, arg2, arg3: u64) -> (out1: u64) { +@(optimization_mode="none") +cmovznz_u64 :: proc "contextless" (arg1: u1, arg2, arg3: u64) -> (out1: u64) { x1 := (u64(arg1) * 0xffffffffffffffff) x2 := ((x1 & arg3) | ((~x1) & arg2)) out1 = x2 return } -cmovznz_u32 :: #force_inline proc "contextless" (arg1: u1, arg2, arg3: u32) -> (out1: u32) { +@(optimization_mode="none") +cmovznz_u32 :: proc "contextless" (arg1: u1, arg2, arg3: u32) -> (out1: u32) { x1 := (u32(arg1) * 0xffffffff) x2 := ((x1 & arg3) | ((~x1) & arg2)) out1 = x2 diff --git a/core/crypto/_fiat/field_curve25519/field51.odin b/core/crypto/_fiat/field_curve25519/field51.odin index e4ca98b57..0be94eb51 100644 --- a/core/crypto/_fiat/field_curve25519/field51.odin +++ b/core/crypto/_fiat/field_curve25519/field51.odin @@ -305,7 +305,8 @@ fe_opp :: proc "contextless" (out1: ^Loose_Field_Element, arg1: ^Tight_Field_Ele out1[4] = x5 } -fe_cond_assign :: proc "contextless" (out1, arg1: ^Tight_Field_Element, arg2: int) { +@(optimization_mode="none") +fe_cond_assign :: #force_no_inline proc "contextless" (out1, arg1: ^Tight_Field_Element, arg2: int) { x1 := fiat.cmovznz_u64(fiat.u1(arg2), out1[0], arg1[0]) x2 := fiat.cmovznz_u64(fiat.u1(arg2), out1[1], arg1[1]) x3 := fiat.cmovznz_u64(fiat.u1(arg2), out1[2], arg1[2]) @@ -596,7 +597,8 @@ fe_set :: proc "contextless" (out1, arg1: ^Tight_Field_Element) { out1[4] = x5 } -fe_cond_swap :: proc "contextless" (out1, out2: ^Tight_Field_Element, arg1: int) { +@(optimization_mode="none") +fe_cond_swap :: #force_no_inline proc "contextless" (out1, out2: ^Tight_Field_Element, arg1: int) { mask := -u64(arg1) x := (out1[0] ~ out2[0]) & mask x1, y1 := out1[0] ~ x, out2[0] ~ x diff --git a/core/crypto/_fiat/field_poly1305/field4344.odin b/core/crypto/_fiat/field_poly1305/field4344.odin index ba9bc2694..8e8a7cc78 100644 --- a/core/crypto/_fiat/field_poly1305/field4344.odin +++ b/core/crypto/_fiat/field_poly1305/field4344.odin @@ -201,7 +201,8 @@ fe_opp :: proc "contextless" (out1: ^Loose_Field_Element, arg1: ^Tight_Field_Ele out1[2] = x3 } -fe_cond_assign :: proc "contextless" (out1, arg1: ^Tight_Field_Element, arg2: bool) { +@(optimization_mode="none") +fe_cond_assign :: #force_no_inline proc "contextless" (out1, arg1: ^Tight_Field_Element, arg2: bool) { x1 := fiat.cmovznz_u64(fiat.u1(arg2), out1[0], arg1[0]) x2 := fiat.cmovznz_u64(fiat.u1(arg2), out1[1], arg1[1]) x3 := fiat.cmovznz_u64(fiat.u1(arg2), out1[2], arg1[2]) @@ -342,7 +343,8 @@ fe_set :: #force_inline proc "contextless" (out1, arg1: ^Tight_Field_Element) { out1[2] = x3 } -fe_cond_swap :: proc "contextless" (out1, out2: ^Tight_Field_Element, arg1: bool) { +@(optimization_mode="none") +fe_cond_swap :: #force_no_inline proc "contextless" (out1, out2: ^Tight_Field_Element, arg1: bool) { mask := -u64(arg1) x := (out1[0] ~ out2[0]) & mask x1, y1 := out1[0] ~ x, out2[0] ~ x |