Add a few more constant-time utility functions.
Imported from upstream's 9bed73adaa6f834177f29e478d9a2247a6577c04.
Upstream's commit appears to have been based on BoringSSL's commits to
improve the constant-time behaviour of RSA padding checks and thus I've
not tried to import those bits of the change.
Change-Id: I0ea5775b0f1e18741bbbc9f792a6af0d3d2a4caf
diff --git a/crypto/internal.h b/crypto/internal.h
index a63f7a7..f32d369 100644
--- a/crypto/internal.h
+++ b/crypto/internal.h
@@ -169,7 +169,7 @@
* can be written as
*
* unsigned int lt = constant_time_lt(a, b);
- * c = a & lt | b & ~lt; */
+ * c = constant_time_select(lt, a, b); */
/* constant_time_msb returns the given value with the MSB copied to all the
* other bits. Uses the fact that arithmetic shift shifts-in the sign bit.
@@ -230,6 +230,27 @@
return (uint8_t)(constant_time_eq(a, b));
}
+/* constant_time_select returns (mask & a) | (~mask & b). When |mask| is all 1s
+ * or all 0s (as returned by the methods above), the select methods return
+ * either |a| (if |mask| is nonzero) or |b| (if |mask| is zero). */
+static inline unsigned int constant_time_select(unsigned int mask,
+ unsigned int a, unsigned int b) {
+ return (mask & a) | (~mask & b);
+}
+
+/* constant_time_select_8 acts like |constant_time_select| but operates on
+ * 8-bit values. */
+static inline uint8_t constant_time_select_8(uint8_t mask, uint8_t a,
+ uint8_t b) {
+ return (uint8_t)(constant_time_select(mask, a, b));
+}
+
+/* constant_time_select_int acts like |constant_time_select| but operates on
+ * ints. */
+static inline int constant_time_select_int(unsigned int mask, int a, int b) {
+ return (int)(constant_time_select(mask, (unsigned)(a), (unsigned)(b)));
+}
+
#if defined(__cplusplus)
} /* extern C */
