| commit | 6a289b3ec439d24729cdbdb69b8d99b82a9904fc | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Sun Apr 22 22:34:29 2018 -0400 |
| committer | Adam Langley <agl@google.com> | Wed Apr 25 16:12:06 2018 +0000 |
| tree | db6a5357ff6eeb5e3207afb60ef74c6becd0edc6 | |
| parent | 06c28d8e51915b4d94682345d14032e319816dbb [diff] |
Remove EC_POINTs_make_affine and related logic. This does not appear to actually pull its weight. The purpose of this logic is to switch some adds to the faster add_mixed in the wNAF code, at the cost of a rather expensive inversion. This optimization kicks in for generic curves, so P-384 and P-521: With: Did 32130 ECDSA P-384 signing operations in 30077563us (1068.2 ops/sec) Did 27456 ECDSA P-384 verify operations in 30073086us (913.0 ops/sec) Did 14122 ECDSA P-521 signing operations in 30077407us (469.5 ops/sec) Did 11973 ECDSA P-521 verify operations in 30037330us (398.6 ops/sec) Without: Did 32445 ECDSA P-384 signing operations in 30069721us (1079.0 ops/sec) Did 27056 ECDSA P-384 verify operations in 30032303us (900.9 ops/sec) Did 13905 ECDSA P-521 signing operations in 30000430us (463.5 ops/sec) Did 11433 ECDSA P-521 verify operations in 30021876us (380.8 ops/sec) For single-point multiplication, the optimization is not useful. This makes sense as we only have one table's worth of additions to convert but still pay for the inversion. For double-point multiplication, it is slightly useful for P-384 and very useful for P-521. However, the next change to stack-allocate EC_FELEMs will more than compensate for removing it. (The immediate goal here is to simplify the EC_FELEM story.) Additionally, that this optimization was not useful for single-point multiplication implies that, should we wish to recover this, a modest 8-entry pre-computed (affine) base point table should have the same effect or better. Update-Note: I do not believe anything was calling either of these functions. (If necessary, we can always add no-op stubs as whether a point is affine is not visible to external code. It previously kicked in some optimizations, but those were removed for constant-time needs anyway.) Bug: 239 Change-Id: Ic9c51b001c45595cfe592274c7d5d652f4234839 Reviewed-on: https://boringssl-review.googlesource.com/27667 Reviewed-by: Adam Langley <agl@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
There are other files in this directory which might be helpful: