tree 947423e4348de22b85242b7e1bbc405df3d82ffb
parent d72e47fddbbb2938ff3eb737bb4491647fac8bac
author David Benjamin <davidben@google.com> 1559189431 -0400
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1559249086 +0000

Split ec_point_mul_scalar into two operations.

While it appears that we internally support constant-time
dual multiplication, it is not actually constant-time. Integrating the
two operations means we hit the doubling branch. Instead, replace the
constant-time functions with single multiplication functions, one for
arbitrary points and one for the base point. This simplifies timing
analysis of the EC_METHODs.

This CL only changes the wrapper functions. A subsequent CL will change
the EC_METHOD hooks. We conservatively assume EC_POINT_mul callers
expect secret scalars and split it into two multiplications and an
addition if needed.

Update-Note: EC_POINT_mul may get slower if called with both g_scalar
and p_scalar non-NULL. If the scalars were secret, this plugs a timing
leak (note neither ECDH nor ECDSA signing use such an operation). If
acting on public scalars, notably ECDSA verify, this slowdown is not
inherently necessary. If necessary, we can expose a public version of
ec_point_mul_scalar_public, but callers should be using BoringSSL's
ECDSA verify API instead.

Change-Id: I9c20b660ce4b58dc633588cfd5b2e97a40203ec3
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/36224
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>