From 8f682e8f8e59eeda6df3e964bf5de685b76d2794 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 27 Apr 2026 12:32:38 +0200 Subject: [PATCH] ecp: clarify contract of internal function MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The "shortcut" implementation was using the fact that this function is called in a single place where we know that the top limb of A is zero. But the function's documentation was not stating that as a requirement. Align the documentation and "non-shortcut" implementation on the "shortcut" implementation. This should be a tiny bit better for performance: using the fact that A's top limb is zero means we have one limb less to load from memory. (Copying is load + store, while setting to 0 is only a store.) Signed-off-by: Manuel Pégourié-Gonnard --- library/ecp_curves.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/library/ecp_curves.c b/library/ecp_curves.c index 3baed93439..45d09561c3 100644 --- a/library/ecp_curves.c +++ b/library/ecp_curves.c @@ -5492,23 +5492,25 @@ cleanup: } /* Copy and shift right: X = A >> 224 - * Both X and A must be P448_WIDTH + 1 limbs */ + * X must be P448_WIDTH + 1, and A must be P448_WIDTH limbs */ static void ecp_copy_shift_r_224(mbedtls_mpi_uint *X, const mbedtls_mpi_uint *A) { #if defined(MBEDTLS_HAVE_INT64) && defined(MBEDTLS_IS_BIG_ENDIAN) /* No need to copy lower limbs, they'll be shifted away. - * P448_WIDTH + 1 = P224_WIDTH_MIN + (P224_WIDTH_MAX + 1) */ - memcpy(X + P224_WIDTH_MIN, A + P224_WIDTH_MIN, (P224_WIDTH_MAX + 1) * ciL); + * P448_WIDTH = P224_WIDTH_MIN + P224_WIDTH_MAX */ + memcpy(X + P224_WIDTH_MIN, A + P224_WIDTH_MIN, P224_WIDTH_MAX * ciL); + X[P448_WIDTH] = 0; mbedtls_mpi_core_shift_r(X, P448_WIDTH + 1, 224); #else - /* Shortcut for 32-bit and little-endian 64-bit. */ + /* Shortcut for 32-bit and little-endian 64-bit. + * P448_WITDH * ciL = 2 * P224_SIZE */ memcpy(X, (char *) A + P224_SIZE, P224_SIZE); memset((char *) X + P224_SIZE, 0, P224_SIZE + ciL); #endif } -/* Shift left: X <<= 224 +/* In-place shift left: X <<= 224 * X must be P448_WIDTH + 1 limbs */ static void ecp_shift_l_224(mbedtls_mpi_uint *X) {