From b4a310b47261d6b4ee98d855631bdf07977755db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= <mpg@elzevir.fr>
Date: Tue, 13 Nov 2012 20:57:00 +0100
Subject: [PATCH] Added a selftest about SPA resistance

---
 library/ecp.c                        | 82 +++++++++++++++++++++++++++-
 programs/test/selftest.c             |  6 ++
 tests/suites/test_suite_ecp.data     |  4 ++
 tests/suites/test_suite_ecp.function |  7 +++
 4 files changed, 98 insertions(+), 1 deletion(-)

diff --git a/library/ecp.c b/library/ecp.c
index 748cccb93..05f642343 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -38,6 +38,14 @@
 #include "polarssl/ecp.h"
 #include <limits.h>
 
+#if defined(POLARSSL_SELF_TEST)
+/*
+ * Counts of point addition and doubling operations.
+ * Used to test resistance of point multiplication to SPA/timing attacks.
+ */
+unsigned long add_count, dbl_count;
+#endif
+
 /*
  * Initialize (the components of) a point
  */
@@ -505,6 +513,10 @@ static int ecp_double_jac( const ecp_group *grp, ecp_point *R,
     int ret;
     mpi T1, T2, T3, X, Y, Z;
 
+#if defined(POLARSSL_SELF_TEST)
+    dbl_count++;
+#endif
+
     if( mpi_cmp_int( &P->Z, 0 ) == 0 )
         return( ecp_set_zero( R ) );
 
@@ -567,6 +579,10 @@ static int ecp_add_mixed( const ecp_group *grp, ecp_point *R,
     int ret;
     mpi T1, T2, T3, T4, X, Y, Z;
 
+#if defined(POLARSSL_SELF_TEST)
+    add_count++;
+#endif
+
     /*
      * Trivial cases: P == 0 or Q == 0
      * (Check Q first, so that we know Q != 0 when we compute -Q.)
@@ -738,7 +754,71 @@ cleanup:
  */
 int ecp_self_test( int verbose )
 {
-    return( verbose++ );
+    int ret;
+    size_t i;
+    ecp_group grp;
+    ecp_point R;
+    mpi m;
+    unsigned long add_c_prev, dbl_c_prev;
+    char *exponents[] =
+    {
+        "400000000000000000000000000000000000000000000000",
+        "7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
+        "555555555555555555555555555555555555555555555555",
+        "5EA6F389A38B8BC81E767753B15AA5569E1782E30ABE7D25",
+        "000000000000000000000000000000000000000000000010",
+    };
+
+    ecp_group_init( &grp );
+    ecp_point_init( &R );
+    mpi_init( &m );
+
+    MPI_CHK( ecp_use_known_dp( &grp, POLARSSL_ECP_DP_SECP192R1 ) );
+
+    if( verbose != 0 )
+        printf( "  ECP test #1 (SPA resistance): " );
+
+    add_count = 0;
+    dbl_count = 0;
+    MPI_CHK( mpi_read_string( &m, 16, exponents[0] ) );
+    MPI_CHK( ecp_mul( &grp, &R, &m, &grp.G ) );
+
+    for( i = 1; i < sizeof( exponents ) / sizeof( exponents[0] ); i++ )
+    {
+        add_c_prev = add_count;
+        dbl_c_prev = dbl_count;
+        add_count = 0;
+        dbl_count = 0;
+
+        MPI_CHK( mpi_read_string( &m, 16, exponents[i] ) );
+        MPI_CHK( ecp_mul( &grp, &R, &m, &grp.G ) );
+
+        if( add_count != add_c_prev || dbl_count != dbl_c_prev )
+        {
+            if( verbose != 0 )
+                printf( "failed (%zu)\n", i );
+
+            ret = 1;
+            goto cleanup;
+        }
+    }
+
+    if( verbose != 0 )
+        printf( "passed\n" );
+
+cleanup:
+
+    if( ret < 0 && verbose != 0 )
+        printf( "Unexpected error, return code = %08X\n", ret );
+
+    ecp_group_free( &grp );
+    ecp_point_free( &R );
+    mpi_free( &m );
+
+    if( verbose != 0 )
+        printf( "\n" );
+
+    return( ret );
 }
 
 #endif
diff --git a/programs/test/selftest.c b/programs/test/selftest.c
index 8dddf3481..333e3a16d 100644
--- a/programs/test/selftest.c
+++ b/programs/test/selftest.c
@@ -50,6 +50,7 @@
 #include "polarssl/x509.h"
 #include "polarssl/xtea.h"
 #include "polarssl/pbkdf2.h"
+#include "polarssl/ecp.h"
 
 int main( int argc, char *argv[] )
 {
@@ -155,6 +156,11 @@ int main( int argc, char *argv[] )
         return( ret );
 #endif
 
+#if defined(POLARSSL_ECP_C)
+    if( ( ret = ecp_self_test( v ) ) != 0 )
+        return( ret );
+#endif
+
 #else
     printf( " POLARSSL_SELF_TEST not defined.\n" );
 #endif
diff --git a/tests/suites/test_suite_ecp.data b/tests/suites/test_suite_ecp.data
index c0dd0189d..71d5fad98 100644
--- a/tests/suites/test_suite_ecp.data
+++ b/tests/suites/test_suite_ecp.data
@@ -114,3 +114,7 @@ ecp_test_vect:SECP384R1:"D27335EA71664AF244DD14E9FD1260715DFD8A7965571C48D709EE7
 
 ECP test vectors secp521r1
 ecp_test_vect:SECP521R1:"0113F82DA825735E3D97276683B2B74277BAD27335EA71664AF2430CC4F33459B9669EE78B3FFB9B8683015D344DCBFEF6FB9AF4C6C470BE254516CD3C1A1FB47362":"01EBB34DD75721ABF8ADC9DBED17889CBB9765D90A7C60F2CEF007BB0F2B26E14881FD4442E689D61CB2DD046EE30E3FFD20F9A45BBDF6413D583A2DBF59924FD35C":"00F6B632D194C0388E22D8437E558C552AE195ADFD153F92D74908351B2F8C4EDA94EDB0916D1B53C020B5EECAED1A5FC38A233E4830587BB2EE3489B3B42A5A86A4":"00CEE3480D8645A17D249F2776D28BAE616952D1791FDB4B70F7C3378732AA1B22928448BCD1DC2496D435B01048066EBE4F72903C361B1A9DC1193DC2C9D0891B96":"010EBFAFC6E85E08D24BFFFCC1A4511DB0E634BEEB1B6DEC8C5939AE44766201AF6200430BA97C8AC6A0E9F08B33CE7E9FEEB5BA4EE5E0D81510C24295B8A08D0235":"00A4A6EC300DF9E257B0372B5E7ABFEF093436719A77887EBB0B18CF8099B9F4212B6E30A1419C18E029D36863CC9D448F4DBA4D2A0E60711BE572915FBD4FEF2695":"00CDEA89621CFA46B132F9E4CFE2261CDE2D4368EB5656634C7CC98C7A00CDE54ED1866A0DD3E6126C9D2F845DAFF82CEB1DA08F5D87521BB0EBECA77911169C20CC":"00F9A71641029B7FC1A808AD07CD4861E868614B865AFBECAB1F2BD4D8B55EBCB5E3A53143CEB2C511B1AE0AF5AC827F60F2FD872565AC5CA0A164038FE980A7E4BD"
+
+ECP selftest
+depends_on:POLARSSL_SELF_TEST
+ecp_selftest:
diff --git a/tests/suites/test_suite_ecp.function b/tests/suites/test_suite_ecp.function
index f494f4e67..389bc6e91 100644
--- a/tests/suites/test_suite_ecp.function
+++ b/tests/suites/test_suite_ecp.function
@@ -194,3 +194,10 @@ ecp_fast_mod:id:N
     ecp_group_free( &grp );
 }
 END_CASE
+
+BEGIN_CASE
+ecp_selftest:
+{
+    TEST_ASSERT( ecp_self_test( 0 ) == 0 );
+}
+END_CASE