Constant-time EC scalar multiplication for prime and binary curves, plus AES bitsliced key-schedule hardening

CryptoLib.Benchmark/Delphi/CryptoLib.BenchmarkConsole.dpr

@@ -389,6 +389,12 @@ uses
   ClpMacUtilities in '..\..\CryptoLib\src\Crypto\Macs\ClpMacUtilities.pas',
   ClpMiscObjectIdentifiers in '..\..\CryptoLib\src\Asn1\Misc\ClpMiscObjectIdentifiers.pas',
   ClpMultipliers in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpMultipliers.pas',
+  ClpIFpFieldOps in '..\..\CryptoLib\src\Interfaces\Math\EC\Multiplier\ClpIFpFieldOps.pas',
+  ClpHomogeneousPoint in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpHomogeneousPoint.pas',
+  ClpFixedWindowCTMultiplier in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpFixedWindowCTMultiplier.pas',
+  ClpIF2mFieldOps in '..\..\CryptoLib\src\Interfaces\Math\EC\Multiplier\ClpIF2mFieldOps.pas',
+  ClpLopezDahabLadder in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpLopezDahabLadder.pas',
+  ClpF2mMontgomeryLadderCTMultiplier in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpF2mMontgomeryLadderCTMultiplier.pas',
   ClpNistNamedCurves in '..\..\CryptoLib\src\Asn1\Nist\ClpNistNamedCurves.pas',
   ClpNistObjectIdentifiers in '..\..\CryptoLib\src\Asn1\Nist\ClpNistObjectIdentifiers.pas',
   ClpNoOpDigest in '..\..\CryptoLib\src\Crypto\Digests\ClpNoOpDigest.pas',

CryptoLib.Examples/Delphi.Examples/CryptoLib.Examples.dpr

@@ -406,6 +406,12 @@ uses
   ClpMacUtilities in '..\..\CryptoLib\src\Crypto\Macs\ClpMacUtilities.pas',
   ClpMiscObjectIdentifiers in '..\..\CryptoLib\src\Asn1\Misc\ClpMiscObjectIdentifiers.pas',
   ClpMultipliers in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpMultipliers.pas',
+  ClpIFpFieldOps in '..\..\CryptoLib\src\Interfaces\Math\EC\Multiplier\ClpIFpFieldOps.pas',
+  ClpHomogeneousPoint in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpHomogeneousPoint.pas',
+  ClpFixedWindowCTMultiplier in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpFixedWindowCTMultiplier.pas',
+  ClpIF2mFieldOps in '..\..\CryptoLib\src\Interfaces\Math\EC\Multiplier\ClpIF2mFieldOps.pas',
+  ClpLopezDahabLadder in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpLopezDahabLadder.pas',
+  ClpF2mMontgomeryLadderCTMultiplier in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpF2mMontgomeryLadderCTMultiplier.pas',
   ClpNistNamedCurves in '..\..\CryptoLib\src\Asn1\Nist\ClpNistNamedCurves.pas',
   ClpNistObjectIdentifiers in '..\..\CryptoLib\src\Asn1\Nist\ClpNistObjectIdentifiers.pas',
   ClpNoOpDigest in '..\..\CryptoLib\src\Crypto\Digests\ClpNoOpDigest.pas',

CryptoLib.Tests/Delphi.Tests/CryptoLib.Tests.Mobile.dpr

@@ -383,6 +383,12 @@ uses
   ClpMacUtilities in '..\..\CryptoLib\src\Crypto\Macs\ClpMacUtilities.pas',
   ClpMiscObjectIdentifiers in '..\..\CryptoLib\src\Asn1\Misc\ClpMiscObjectIdentifiers.pas',
   ClpMultipliers in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpMultipliers.pas',
+  ClpIFpFieldOps in '..\..\CryptoLib\src\Interfaces\Math\EC\Multiplier\ClpIFpFieldOps.pas',
+  ClpHomogeneousPoint in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpHomogeneousPoint.pas',
+  ClpFixedWindowCTMultiplier in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpFixedWindowCTMultiplier.pas',
+  ClpIF2mFieldOps in '..\..\CryptoLib\src\Interfaces\Math\EC\Multiplier\ClpIF2mFieldOps.pas',
+  ClpLopezDahabLadder in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpLopezDahabLadder.pas',
+  ClpF2mMontgomeryLadderCTMultiplier in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpF2mMontgomeryLadderCTMultiplier.pas',
   ClpNistNamedCurves in '..\..\CryptoLib\src\Asn1\Nist\ClpNistNamedCurves.pas',
   ClpNistObjectIdentifiers in '..\..\CryptoLib\src\Asn1\Nist\ClpNistObjectIdentifiers.pas',
   ClpNoOpDigest in '..\..\CryptoLib\src\Crypto\Digests\ClpNoOpDigest.pas',
@@ -929,6 +935,8 @@ uses
   //FixedPointTests in '..\src\Math\EC\FixedPointTests.pas',
   AESTests in '..\src\Crypto\AESTests.pas',
   AesBitSlicedTests in '..\src\Crypto\AesBitSlicedTests.pas',
+  ECDHPrimeConstantTimeTests in '..\src\Crypto\ECDHPrimeConstantTimeTests.pas',
+  ECDHBinaryConstantTimeTests in '..\src\Crypto\ECDHBinaryConstantTimeTests.pas',
   BlockCipherTestBase in '..\src\Crypto\BlockCipherTestBase.pas',
   AesBlockCipherTestBase in '..\src\Crypto\AesBlockCipherTestBase.pas',
   AesLightTests in '..\src\Crypto\AesLightTests.pas',

CryptoLib.Tests/Delphi.Tests/CryptoLib.Tests.Mobile.dproj

@@ -726,6 +726,12 @@
         <DCCReference Include="..\..\CryptoLib\src\Crypto\Macs\ClpMacUtilities.pas"/>
         <DCCReference Include="..\..\CryptoLib\src\Asn1\Misc\ClpMiscObjectIdentifiers.pas"/>
         <DCCReference Include="..\..\CryptoLib\src\Math\EC\Multiplier\ClpMultipliers.pas"/>
+        <DCCReference Include="..\..\CryptoLib\src\Interfaces\Math\EC\Multiplier\ClpIFpFieldOps.pas"/>
+        <DCCReference Include="..\..\CryptoLib\src\Math\EC\Multiplier\ClpHomogeneousPoint.pas"/>
+        <DCCReference Include="..\..\CryptoLib\src\Math\EC\Multiplier\ClpFixedWindowCTMultiplier.pas"/>
+        <DCCReference Include="..\..\CryptoLib\src\Interfaces\Math\EC\Multiplier\ClpIF2mFieldOps.pas"/>
+        <DCCReference Include="..\..\CryptoLib\src\Math\EC\Multiplier\ClpLopezDahabLadder.pas"/>
+        <DCCReference Include="..\..\CryptoLib\src\Math\EC\Multiplier\ClpF2mMontgomeryLadderCTMultiplier.pas"/>
         <DCCReference Include="..\..\CryptoLib\src\Asn1\Nist\ClpNistNamedCurves.pas"/>
         <DCCReference Include="..\..\CryptoLib\src\Asn1\Nist\ClpNistObjectIdentifiers.pas"/>
         <DCCReference Include="..\..\CryptoLib\src\Crypto\Digests\ClpNoOpDigest.pas"/>
@@ -1268,6 +1274,8 @@
         <DCCReference Include="..\src\Rngs\Drbg\CtrDrbgTests.pas"/>
         <DCCReference Include="..\src\Crypto\AESTests.pas"/>
         <DCCReference Include="..\src\Crypto\AesBitSlicedTests.pas"/>
+        <DCCReference Include="..\src\Crypto\ECDHPrimeConstantTimeTests.pas"/>
+        <DCCReference Include="..\src\Crypto\ECDHBinaryConstantTimeTests.pas"/>
         <DCCReference Include="..\src\Crypto\BlockCipherTestBase.pas"/>
         <DCCReference Include="..\src\Crypto\AesBlockCipherTestBase.pas"/>
         <DCCReference Include="..\src\Crypto\AesLightTests.pas"/>

CryptoLib.Tests/Delphi.Tests/CryptoLib.Tests.dpr

@@ -402,6 +402,12 @@ uses
   ClpMacUtilities in '..\..\CryptoLib\src\Crypto\Macs\ClpMacUtilities.pas',
   ClpMiscObjectIdentifiers in '..\..\CryptoLib\src\Asn1\Misc\ClpMiscObjectIdentifiers.pas',
   ClpMultipliers in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpMultipliers.pas',
+  ClpIFpFieldOps in '..\..\CryptoLib\src\Interfaces\Math\EC\Multiplier\ClpIFpFieldOps.pas',
+  ClpHomogeneousPoint in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpHomogeneousPoint.pas',
+  ClpFixedWindowCTMultiplier in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpFixedWindowCTMultiplier.pas',
+  ClpIF2mFieldOps in '..\..\CryptoLib\src\Interfaces\Math\EC\Multiplier\ClpIF2mFieldOps.pas',
+  ClpLopezDahabLadder in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpLopezDahabLadder.pas',
+  ClpF2mMontgomeryLadderCTMultiplier in '..\..\CryptoLib\src\Math\EC\Multiplier\ClpF2mMontgomeryLadderCTMultiplier.pas',
   ClpNistNamedCurves in '..\..\CryptoLib\src\Asn1\Nist\ClpNistNamedCurves.pas',
   ClpNistObjectIdentifiers in '..\..\CryptoLib\src\Asn1\Nist\ClpNistObjectIdentifiers.pas',
   ClpNoOpDigest in '..\..\CryptoLib\src\Crypto\Digests\ClpNoOpDigest.pas',
@@ -950,6 +956,8 @@ uses
   FixedPointTests in '..\src\Math\EC\FixedPointTests.pas',
   AESTests in '..\src\Crypto\AESTests.pas',
   AesBitSlicedTests in '..\src\Crypto\AesBitSlicedTests.pas',
+  ECDHPrimeConstantTimeTests in '..\src\Crypto\ECDHPrimeConstantTimeTests.pas',
+  ECDHBinaryConstantTimeTests in '..\src\Crypto\ECDHBinaryConstantTimeTests.pas',
   BlockCipherTestBase in '..\src\Crypto\BlockCipherTestBase.pas',
   AesBlockCipherTestBase in '..\src\Crypto\AesBlockCipherTestBase.pas',
   AesLightTests in '..\src\Crypto\AesLightTests.pas',

CryptoLib.Tests/FreePascal.Tests/CryptoLib.Tests.lpi

@@ -79,7 +79,7 @@
         <PackageName Value="FCL"/>
       </Item4>
     </RequiredPackages>
-    <Units Count="205">
+    <Units Count="207">
       <Unit0>
         <Filename Value="CryptoLib.lpr"/>
         <IsPartOfProject Value="True"/>
@@ -901,6 +901,14 @@
         <Filename Value="..\src\Crypto\AesBitSlicedTests.pas"/>
         <IsPartOfProject Value="True"/>
       </Unit204>
+      <Unit205>
+        <Filename Value="..\src\Crypto\ECDHPrimeConstantTimeTests.pas"/>
+        <IsPartOfProject Value="True"/>
+      </Unit205>
+      <Unit206>
+        <Filename Value="..\src\Crypto\ECDHBinaryConstantTimeTests.pas"/>
+        <IsPartOfProject Value="True"/>
+      </Unit206>
     </Units>
   </ProjectOptions>
   <CompilerOptions>

CryptoLib.Tests/FreePascal.Tests/CryptoLib.lpr

@@ -40,9 +40,10 @@
   AeadTestUtilities, GcmReorderTests, GCMTests, GcmSivTests, GMacTests,
   Pkcs12Tests, Bip327MuSig2Tests, Bip340SchnorrTests, AlgorithmFinderTests,
   MlKemTests, MlDsaTests, PqcPkcsTests, SlhDsaTests, Lib25519Tests,
-  Asn1CipherBuilderWithKeyTests, AesBitSlicedTests, CryptoLibTestBase,
-  PkixFoundationTests, PkixNameConstraintTests, PkixComparerTests,
-  CertPathTests, CertPathValidatorTests, PkixPolicyMappingTests, OcspTests,
+  Asn1CipherBuilderWithKeyTests, AesBitSlicedTests, ECDHPrimeConstantTimeTests,
+  ECDHBinaryConstantTimeTests, CryptoLibTestBase, PkixFoundationTests,
+  PkixNameConstraintTests, PkixComparerTests, CertPathTests,
+  CertPathValidatorTests, PkixPolicyMappingTests, OcspTests,
   CryptoLibHashSetTests, PkitsTestBase, NistCertPathTests, AttrCertPathTests,
   CtrDrbgTests, DrbgTestSupport, HashDrbgTests, HMacDrbgTests,
   SimdSelectSlotTests, BinaryPrimitivesTests, PkcsEncryptedPrivateKeyInfoTests,

CryptoLib.Tests/FreePascal.Tests/CryptoLibConsole.lpi

@@ -39,7 +39,7 @@
         <PackageName Value="FCL"/>
       </Item2>
     </RequiredPackages>
-    <Units Count="205">
+    <Units Count="207">
       <Unit0>
         <Filename Value="CryptoLibConsole.lpr"/>
         <IsPartOfProject Value="True"/>
@@ -860,6 +860,14 @@
         <Filename Value="..\src\Crypto\AesBitSlicedTests.pas"/>
         <IsPartOfProject Value="True"/>
       </Unit204>
+      <Unit205>
+        <Filename Value="..\src\Crypto\ECDHPrimeConstantTimeTests.pas"/>
+        <IsPartOfProject Value="True"/>
+      </Unit205>
+      <Unit206>
+        <Filename Value="..\src\Crypto\ECDHBinaryConstantTimeTests.pas"/>
+        <IsPartOfProject Value="True"/>
+      </Unit206>
     </Units>
   </ProjectOptions>
   <CompilerOptions>

CryptoLib.Tests/FreePascal.Tests/CryptoLibConsole.lpr

@@ -57,7 +57,8 @@
   OpenSslVectors, PkcsVectors, CertVectors, PkitsVectors, PqcSampleCredentials,
   CsvVectorLoaderBase, TestKeyBuilders, PemDerCodec, PemReaderVectors,
   Argon2Vectors, PqcTestVectors, DrbgTestVectors, Int32Tests, Int64Tests,
-  ByteUtilitiesTests, IPAddressUtilitiesTests, PemReaderTests;
+  ByteUtilitiesTests, IPAddressUtilitiesTests, PemReaderTests,
+  ECDHPrimeConstantTimeTests, ECDHBinaryConstantTimeTests;
 
 type
 

CryptoLib.Tests/src/Crypto/AesBitSlicedTests.pas

@@ -79,6 +79,8 @@   TTestAesBitSliced = class(TAesBlockCipherTestBase)
     procedure TestAesGcmEndToEnd;
     procedure TestInvalidKeyLength;
     procedure TestResetAndReInit;
+    procedure TestReInitDifferentKeySize;
+    procedure TestCallerKeyPreserved;
   end;
 
 implementation
@@ -444,6 +446,57 @@ procedure TTestAesBitSliced.TestResetAndReInit;
     Fail('ProcessBlock after re-Init produced a different result');
 end;
 
+procedure TTestAesBitSliced.TestReInitDifferentKeySize;
+var
+  LBlock, LOut: TBytes;
+  LEngine: IBlockCipher;
+begin
+  LBlock := DecodeHex(KAT_PLAIN);
+  System.SetLength(LOut, 16);
+  LEngine := TAesBitSlicedEngine.Create();
+
+  LEngine.Init(True, TKeyParameter.Create(DecodeHex(KAT_KEY_128)) as ICipherParameters);
+  LEngine.ProcessBlock(LBlock, 0, LOut, 0);
+  if not AreEqual(LOut, DecodeHex(KAT_CIPHER_128)) then
+    Fail('AES-128 encrypt wrong before re-key');
+
+  // Re-Init the same instance with a larger key: exercises the FSkey pre-wipe + realloc.
+  LEngine.Init(True, TKeyParameter.Create(DecodeHex(KAT_KEY_256)) as ICipherParameters);
+  LEngine.ProcessBlock(LBlock, 0, LOut, 0);
+  if not AreEqual(LOut, DecodeHex(KAT_CIPHER_256)) then
+    Fail('AES-256 encrypt wrong after cross-key-size re-Init');
+end;
+
+procedure TTestAesBitSliced.TestCallerKeyPreserved;
+var
+  LKey, LKeyBefore, LBad: TBytes;
+  LEngine: IBlockCipher;
+  LI: Int32;
+  LRaised: Boolean;
+begin
+  // A successful Init must not mutate the caller's key bytes.
+  LKey := DecodeHex(KAT_KEY_128);
+  LKeyBefore := System.Copy(LKey);
+  LEngine := TAesBitSlicedEngine.Create();
+  LEngine.Init(True, TKeyParameter.Create(LKey) as ICipherParameters);
+  if not AreEqual(LKey, LKeyBefore) then
+    Fail('caller key buffer was mutated on a successful Init');
+
+  // An invalid key length must raise (matching TAesEngine).
+  System.SetLength(LBad, 20);
+  for LI := 0 to System.Length(LBad) - 1 do
+    LBad[LI] := Byte($AA);
+  LRaised := False;
+  try
+    LEngine := TAesBitSlicedEngine.Create();
+    LEngine.Init(True, TKeyParameter.Create(LBad) as ICipherParameters);
+  except
+    on E: EArgumentCryptoLibException do
+      LRaised := True;
+  end;
+  CheckTrue(LRaised, 'invalid key length did not raise');
+end;
+
 initialization
 
 {$IFDEF FPC}