Botan 2.1.0 Crypto and TLS for C++11

- Main Page
- Namespaces
- Classes
- Files

- Namespace List
- Namespace Members

Functions
Botan::CT Namespace Reference

## Functions
template<typename T >
void | cond_zero_mem (T cond, T *array, size_t elems)
template<typename T >
void | conditional_copy_mem (T value, T *to, const T *from0, const T *from1, size_t elems)
template<typename T >
T | expand_mask (T x)
template<typename T >
T | expand_top_bit (T a)
template<typename T >
T | is_equal (T x, T y)
template<typename T >
T | is_less (T x, T y)
template<typename T >
T | is_lte (T x, T y)
template<typename T >
T | is_zero (T x)
template<typename T >
T | max (T a, T b)
template<typename T >
T | min (T a, T b)
template<typename T >
void | poison (const T *p, size_t n)
template<typename T >
T | select (T mask, T from0, T from1)
secure_vector< uint8_t > | strip_leading_zeros (const uint8_t in[], size_t length)
secure_vector< uint8_t > | strip_leading_zeros (const secure_vector< uint8_t > &in)
template<typename T >
void | unpoison (const T *p, size_t n)
template<typename T >
void | unpoison (T &p)
template<typename PredT , typename ValT >
ValT | val_or_zero (PredT pred_val, ValT val)

## Function Documentation

template<typename T >

void Botan::CT::cond_zero_mem | ( | T | cond,
|  | T * | array,
|  | size_t | elems
| ) |  |
| inline

Definition at line 153 of file ct_utils.h.

References expand_mask(), and select().

156 {
157 const T mask = CT::expand_mask(cond);
158 const T zero(0);
159
160 for(size_t i = 0; i != elems; ++i)
161 {
162 array[i] = CT::select(mask, zero, array[i]);
163 }
164 }
Botan::CT::expand_mask
T expand_mask(T x)
Definition: ct_utils.h:86
Botan::CT::select
T select(T mask, T from0, T from1)
Definition: ct_utils.h:98
template<typename T >

void Botan::CT::conditional_copy_mem | ( | T | value,
|  | T * | to,
|  | const T * | from0,
|  | const T * | from1,
|  | size_t | elems
| ) |  |
| inline

Definition at line 138 of file ct_utils.h.

References expand_mask(), and select().

Referenced by Botan::bigint_monty_redc(), Botan::PK_Decryptor::decrypt_or_random(), Botan::PKCS7_Padding::unpad(), Botan::ANSI_X923_Padding::unpad(), Botan::OneAndZeros_Padding::unpad(), and Botan::ESP_Padding::unpad().

143 {
144 const T mask = CT::expand_mask(value);
145
146 for(size_t i = 0; i != elems; ++i)
147 {
148 to[i] = CT::select(mask, from0[i], from1[i]);
149 }
150 }
Botan::CT::expand_mask
T expand_mask(T x)
Definition: ct_utils.h:86
Botan::CT::select
T select(T mask, T from0, T from1)
Definition: ct_utils.h:98
template<typename T >

T Botan::CT::expand_mask | ( | T | x | ) |
| inline

Definition at line 86 of file ct_utils.h.

Referenced by Botan::bigint_cnd_abs(), Botan::bigint_cnd_add(), Botan::bigint_cnd_sub(), Botan::bigint_cnd_swap(), cond_zero_mem(), conditional_copy_mem(), is_zero(), Botan::PKCS7_Padding::unpad(), Botan::ANSI_X923_Padding::unpad(), and Botan::ESP_Padding::unpad().

87 {
88 T r = x;
89 // First fold r down to a single bit
90 for(size_t i = 1; i != sizeof(T)*8; i *= 2)
91 r |= r >> i;
92 r &= 1;
93 r = ~(r - 1);
94 return r;
95 }
template<typename T >

T Botan::CT::expand_top_bit | ( | T | a | ) |
| inline

Definition at line 167 of file ct_utils.h.

Referenced by max(), and min().

168 {
169 return expand_mask<T>(a >> (sizeof(T)*8-1));
170 }
template<typename T >

T Botan::CT::is_equal | ( | T | x,
|  | T | y
| ) |  |
| inline

Definition at line 116 of file ct_utils.h.

References is_zero().

Referenced by Botan::PK_Decryptor::decrypt_or_random(), and Botan::PKCS7_Padding::unpad().

117 {
118 return is_zero(x ^ y);
119 }
Botan::CT::is_zero
T is_zero(T x)
Definition: ct_utils.h:110
template<typename T >

T Botan::CT::is_less | ( | T | x,
|  | T | y
| ) |  |
| inline

Definition at line 122 of file ct_utils.h.

123 {
124 /*
125 This expands to a constant time sequence with GCC 5.2.0 on x86-64
126 but something more complicated may be needed for portable const time.
127 */
128 return expand_mask<T>(x < y);
129 }
template<typename T >

T Botan::CT::is_lte | ( | T | x,
|  | T | y
| ) |  |
| inline

Definition at line 132 of file ct_utils.h.

133 {
134 return expand_mask<T>(x <= y);
135 }
template<typename T >

T Botan::CT::is_zero | ( | T | x | ) |
| inline

Definition at line 110 of file ct_utils.h.

References expand_mask().

Referenced by Botan::EC_PublicKey::check_key(), is_equal(), Botan::BigInt::is_nonzero(), Botan::PointGFp::negate(), strip_leading_zeros(), and Botan::ANSI_X923_Padding::unpad().

111 {
112 return ~expand_mask(x);
113 }
Botan::CT::expand_mask
T expand_mask(T x)
Definition: ct_utils.h:86
template<typename T >

T Botan::CT::max | ( | T | a,
|  | T | b
| ) |  |
| inline

Definition at line 173 of file ct_utils.h.

References expand_top_bit(), and select().

Referenced by Botan::GeneralSubtree::decode_from(), Botan::Device_EntropySource::Device_EntropySource(), Botan::GeneralSubtree::GeneralSubtree(), Botan::XMSS_Index_Registry::get(), Botan::mul_add(), Botan::multi_exponentiate(), Botan::operator+(), Botan::BigInt::operator+=(), Botan::operator-(), Botan::BigInt::operator-=(), Botan::operator^(), Botan::GOST_3410_PublicKey::public_key_bits(), and Botan::to_u32bit().

174 {
175 const T a_larger = b - a; // negative if a is larger
176 return select(expand_top_bit(a), a, b);
177 }
Botan::CT::expand_top_bit
T expand_top_bit(T a)
Definition: ct_utils.h:167
Botan::CT::select
T select(T mask, T from0, T from1)
Definition: ct_utils.h:98
template<typename T >

T Botan::CT::min | ( | T | a,
|  | T | b
| ) |  |
| inline

Definition at line 180 of file ct_utils.h.

References expand_top_bit(), and select().

Referenced by Botan::SHA_3::absorb(), Botan::buffer_insert(), Botan::XMSS_Tools::concat(), Botan::DataSource::discard_next(), Botan::gcd(), Botan::GeneralSubtree::GeneralSubtree(), Botan::OS::get_memory_locking_limit(), Botan::GHASH::ghash_update(), Botan::X942_PRF::kdf(), Botan::KDF2::kdf(), Botan::KDF1_18033::kdf(), Botan::HKDF_Extract::kdf(), Botan::HKDF_Expand::kdf(), Botan::mceliece_work_factor(), Botan::OctetString::operator^=(), Botan::DataSource_Memory::peek(), Botan::XTS_Encryption::process(), Botan::CFB_Encryption::process(), Botan::XTS_Decryption::process(), Botan::CFB_Decryption::process(), Botan::CBC_Decryption::process(), Botan::random_prime(), Botan::HMAC_DRBG::randomize_with_input(), Botan::TLS::Blocking_Client::read(), Botan::TLS::Datagram_Handshake_IO::timeout_check(), Botan::TLS::Protocol_Version::to_string(), and Botan::Buffered_Filter::write().

181 {
182 const T a_larger = b - a; // negative if a is larger
183 return select(expand_top_bit(b), b, a);
184 }
Botan::CT::expand_top_bit
T expand_top_bit(T a)
Definition: ct_utils.h:167
Botan::CT::select
T select(T mask, T from0, T from1)
Definition: ct_utils.h:98
template<typename T >

void Botan::CT::poison | ( | const T * | p,
|  | size_t | n
| ) |  |
| inline

Use valgrind to mark the contents of memory as being undefined. Valgrind will accept operations which manipulate undefined values, but will warn if an undefined value is used to decided a conditional jump or a load/store address. So if we poison all of our inputs we can confirm that the operations in question are truly const time when compiled by whatever compiler is in use.

Even better, the VALGRIND_MAKE_MEM_* macros work even when the program is not run under valgrind (though with a few cycles of overhead, which is unfortunate in final binaries as these annotations tend to be used in fairly important loops).

This approach was first used in ctgrind (https://github.com/agl/ctgrind) but calling the valgrind mecheck API directly works just as well and doesn't require a custom patched valgrind.

Definition at line 46 of file ct_utils.h.

References BOTAN_UNUSED.

Referenced by Botan::bigint_monty_redc(), Botan::ct_inverse_mod_odd_modulus(), Botan::curve25519_donna(), Botan::TLS::TLS_CBC_HMAC_AEAD_Decryption::finish(), Botan::PKCS7_Padding::unpad(), Botan::ANSI_X923_Padding::unpad(), Botan::OneAndZeros_Padding::unpad(), and Botan::ESP_Padding::unpad().

47 {
48 #if defined(BOTAN_HAS_VALGRIND)
49 VALGRIND_MAKE_MEM_UNDEFINED(p, n * sizeof(T));
50 #else
51 BOTAN_UNUSED(p);
52 BOTAN_UNUSED(n);
53 #endif
54 }
BOTAN_UNUSED
#define BOTAN_UNUSED(v)
Definition: assert.h:92
template<typename T >

T Botan::CT::select | ( | T | mask,
|  | T | from0,
|  | T | from1
| ) |  |
| inline

Definition at line 98 of file ct_utils.h.

Referenced by Botan::bigint_cnd_abs(), Botan::bigint_cnd_add(), Botan::bigint_cnd_sub(), Botan::bigint_cnd_swap(), cond_zero_mem(), conditional_copy_mem(), max(), min(), Botan::Device_EntropySource::poll(), and val_or_zero().

99 {
100 return (from0 & mask) | (from1 & ~mask);
101 }

secure_vector<uint8_t> Botan::CT::strip_leading_zeros | ( | const uint8_t | in[],
|  | size_t | length
| ) |  |
| inline

Definition at line 186 of file ct_utils.h.

References is_zero().

Referenced by Botan::TLS::Client_Key_Exchange::Client_Key_Exchange(), and strip_leading_zeros().

187 {
188 size_t leading_zeros = 0;
189
190 uint8_t only_zeros = 0xFF;
191
192 for(size_t i = 0; i != length; ++i)
193 {
194 only_zeros &= CT::is_zero(in[i]);
195 leading_zeros += CT::select<uint8_t>(only_zeros, 1, 0);
196 }
197
198 return secure_vector<uint8_t>(in + leading_zeros, in + length);
199 }
Botan::CT::is_zero
T is_zero(T x)
Definition: ct_utils.h:110

secure_vector<uint8_t> Botan::CT::strip_leading_zeros | ( | const secure_vector< uint8_t > & | in | ) |
| inline

Definition at line 201 of file ct_utils.h.

References strip_leading_zeros().

202 {
203 return strip_leading_zeros(in.data(), in.size());
204 }
Botan::CT::strip_leading_zeros
secure_vector< uint8_t > strip_leading_zeros(const secure_vector< uint8_t > &in)
Definition: ct_utils.h:201
template<typename T >

void Botan::CT::unpoison | ( | const T * | p,
|  | size_t | n
| ) |  |
| inline

Definition at line 57 of file ct_utils.h.

References BOTAN_UNUSED.

Referenced by Botan::bigint_monty_redc(), Botan::ct_inverse_mod_odd_modulus(), Botan::curve25519_donna(), Botan::TLS::TLS_CBC_HMAC_AEAD_Decryption::finish(), Botan::PKCS7_Padding::unpad(), Botan::ANSI_X923_Padding::unpad(), Botan::OneAndZeros_Padding::unpad(), and Botan::ESP_Padding::unpad().

58 {
59 #if defined(BOTAN_HAS_VALGRIND)
60 VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T));
61 #else
62 BOTAN_UNUSED(p);
63 BOTAN_UNUSED(n);
64 #endif
65 }
BOTAN_UNUSED
#define BOTAN_UNUSED(v)
Definition: assert.h:92
template<typename T >

void Botan::CT::unpoison | ( | T & | p | ) |
| inline

Definition at line 68 of file ct_utils.h.

References BOTAN_UNUSED.

69 {
70 #if defined(BOTAN_HAS_VALGRIND)
71 VALGRIND_MAKE_MEM_DEFINED(&p, sizeof(T));
72 #else
73 BOTAN_UNUSED(p);
74 #endif
75 }
BOTAN_UNUSED
#define BOTAN_UNUSED(v)
Definition: assert.h:92
template<typename PredT , typename ValT >

ValT Botan::CT::val_or_zero | ( | PredT | pred_val,
|  | ValT | val
| ) |  |
| inline

Definition at line 104 of file ct_utils.h.

References select().

105 {
106 return select(CT::expand_mask<ValT>(pred_val), val, static_cast<ValT>(0));
107 }
Botan::CT::select
T select(T mask, T from0, T from1)
Definition: ct_utils.h:98