)]}'
{
  "commit": "ce9b8737cb3e113c9f986d6a94aeedb09e8207b2",
  "tree": "ee482fd0980974282dca678c4e0513acd97ad92e",
  "parents": [
    "8b4fa1b6b5c8235e51e25bd1615e079bc6f2718b"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Fri Feb 28 12:31:25 2020 -0500"
  },
  "committer": {
    "name": "CQ bot account: commit-bot@chromium.org",
    "email": "commit-bot@chromium.org",
    "time": "Tue Mar 31 22:56:39 2020 +0000"
  },
  "message": "Simplify bn_sub_part_words.\n\nThis function does not need to be so complex. The bulk of\nthe work is done by bn_sub_words. The unrolled loop is only used when\nbn_sub_part_words is called in different-length inputs.\n\nbn_sub_part_words is itself only called from bn_abs_sub_consttime and\nbn_mul_part_recursive. bn_abs_sub_consttime is used to compute p - q in\nRSA key generation so it never sees different-width inputs.\nbn_mul_part_recursive is called from bn_mul_impl if all of the following\nare true:\n\n- Both inputs are at least 16 words long (1024 bits on 64-bit platforms\n  and 512 bits on 32-bit).\n\n- The two inputs are within one word from each other.\n\n- The length of the larger input is one more than a power of two.\n\nThe first condition rules out all EC configurations except P-521 on\n32-bit platforms. The EC code uses bn_mul_mont assembly if available, so\nthis only affects non-x86 and non-ARM 32-bit architectures. Building for\n32-bit x86 without assembly shows no significant change:\n\nBefore:\nDid 88 ECDH P-521 operations in 1014591us (86.7 ops/sec)\nDid 165 ECDSA P-521 signing operations in 1066428us (154.7 ops/sec)\nDid 150 ECDSA P-521 verify operations in 1001749us (149.7 ops/sec)\nAfter:\nDid 90 ECDH P-521 operations in 1045905us (86.0 ops/sec)\nDid 165 ECDSA P-521 signing operations in 1071189us (154.0 ops/sec)\nDid 154 ECDSA P-521 verify operations in 1050509us (146.6 ops/sec)\n\nRSA does meet the first condition, but the third condition rules out all\ncommon RSA sizes, with one quirk: RSA_check_key uses the non-normalized\nBIGNUMs, but RSA_check_key is not called as part of private key\noperations. (https://crbug.com/boringssl/316 discusses what to do about\nRSA longer term. It\u0027s kind of a mess right now.)\n\nBug: 314\nChange-Id: I0bd604e2cd6a75c266f64476c23a730ca1721ea6\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40145\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "dd3158074f312a0ab8ab79960609209d7f9bad67",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/bn/mul.c",
      "new_id": "6e1c3caa27afa6bebe43997aea76d5a8c30819fd",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/bn/mul.c"
    }
  ]
}