From be27e8e25946b2e975258cfb1ea21f6cc4731d8c Mon Sep 17 00:00:00 2001
From: Brian Smith <brian@briansmith.org>
Date: Fri, 20 Oct 2023 10:47:37 -0700
Subject: [PATCH] RSA signature verification: Save one multiplication.
Use David Benjamin's idea.
---
src/arithmetic/bigint.rs | 1 +
src/rsa/public_key.rs | 14 ++++++++++++--
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/src/arithmetic/bigint.rs b/src/arithmetic/bigint.rs
index dd09031a04..de57e1a18b 100644
--- a/src/arithmetic/bigint.rs
+++ b/src/arithmetic/bigint.rs
@@ -163,6 +163,7 @@ fn from_montgomery_amm<M>(limbs: BoxedLimbs<M>, m: &Modulus<M>) -> Elem<M, Unenc
}
}
+#[cfg(any(test, not(target_arch = "x86_64")))]
impl<M> Elem<M, R> {
#[inline]
pub fn into_unencoded(self, m: &Modulus<M>) -> Elem<M, Unencoded> {
diff --git a/src/rsa/public_key.rs b/src/rsa/public_key.rs
index a885cfeced..9673c94a1c 100644
--- a/src/rsa/public_key.rs
+++ b/src/rsa/public_key.rs
@@ -20,6 +20,7 @@ use crate::{
limb::LIMB_BYTES,
};
use alloc::boxed::Box;
+use core::num::NonZeroU64;
/// An RSA Public Key.
#[derive(Clone)]
@@ -137,14 +138,23 @@ impl PublicKey {
///
/// This is constant-time with respect to `base` only.
pub(super) fn exponentiate_elem(&self, base: bigint::Elem<N>) -> bigint::Elem<N> {
+ // The exponent was already checked to be at least 3.
+ let exponent_without_low_bit = NonZeroU64::try_from(self.e.value().get() & !1).unwrap();
+ // The exponent was already checked to be odd.
+ debug_assert_ne!(exponent_without_low_bit, self.e.value());
+
let n = self.n.value();
- let base = bigint::elem_mul(n.oneRR().as_ref(), base, n);
+ let base_r = bigint::elem_mul(n.oneRR().as_ref(), base.clone(), n);
+
// During RSA public key operations the exponent is almost always either
// 65537 (0b10000000000000001) or 3 (0b11), both of which have a Hamming
// weight of 2. The maximum bit length and maximum Hamming weight of the
// exponent is bounded by the value of `PublicExponent::MAX`.
- bigint::elem_exp_vartime(base, self.e.value(), &n.as_partial()).into_unencoded(n)
+ let acc = bigint::elem_exp_vartime(base_r, exponent_without_low_bit, &n.as_partial());
+
+ // Now do the multiplication for the low bit and convert out of the Montgomery domain.
+ bigint::elem_mul(&base, acc, n)
}
}