[base/hardened_memory] Add modular reduction support by siemen11 · Pull Request #29752 · lowRISC/opentitan

siemen11 · 2026-04-12T11:18:17Z

Add helper functions for modular reduction or modular addition/subtraction.

johannheyszl · 2026-04-13T08:02:45Z

+  uint32_t temp_sub[word_len];
+  uint32_t borrow = 0;
+  size_t count = 0;
+  for (; launderw(count) < word_len; count = launderw(count) + 1) {


dummy q: this is constant time for sure?

Counter q, maybe it is better that similar to gcm timing functest, I implement a test to check whether it is?

I added a simple timing functest. It did catch some non-constant time lines

thanks great!

johannheyszl · 2026-04-13T08:04:05Z

+
+  count = 0;
+  for (; launderw(count) < word_len; count = launderw(count) + 1) {
+    dest[count] = (temp_add[count] & mask) | (temp_sub[count] & ~mask);


would we need to check assembly to see if this translates to a const time routine as expected?

I guess this is covered with the test?

The other option here is to use RISC-V's cmov operation, but that would be using assembly instead of code

azure-pipelines · 2026-04-14T09:44:21Z

Azure Pipelines: 1 pipeline(s) were filtered out due to trigger conditions.

johannheyszl

Thanks @siemen11 ! IIUC, the timing is constant LGTM

nasahlpa

Thanks Siemen!

nasahlpa · 2026-04-15T13:08:56Z

+    }
+    HARDENED_CHECK_EQ(j, 2 * word_len);
+
+    uint32_t mask = (borrow == 0) * UINT32_MAX;


We could replace this with:

Suggested change

uint32_t mask = (borrow == 0) * UINT32_MAX;

uint32_t mask = borrow - 1;

nasahlpa

Had again a look, looks good to me.

Maybe @andrea-caforio also can have a look please?

nasahlpa · 2026-04-15T13:44:11Z

 }

+#ifdef OT_PLATFORM_RV32
+static inline uint32_t rv32_addc(uint32_t x, uint32_t y, uint32_t *carry) {


Can you please add a header and some comments similar to rv32_sel.

Added headers

andrea-caforio · 2026-04-15T14:41:13Z

  return (status_t){.value = (int32_t)launder32((uint32_t)OTCRYPTO_OK.value)};
 }
+
+status_t hardened_mod_reduce(const uint32_t *value, const uint32_t *n,


Would it be possible to add a few comments to make it easier to follow along the algorithm from the paper? I'd like to understand it but it's quite opaque like that.

It is opaque because the comment lied hehe, added comments now

Thanks, I think I understand it now.

For the arithmetic sharings for ECC, we use a modular subtraction, implement helper functions which are constant time and hardened against fault injection. Also added a functest for the hardened arithmetic operations to check whether they are constant time and whether they are correct on a RV platform. The functions including the add and sub functions are written to use the risc-v instructions when on such a platform. This is to enforce the constant time nature of the operations. Helper functions for add, sub, and select are created. Signed-off-by: Siemen Dhooghe <sdhooghe@google.com>

lowrisc-ci · 2026-04-17T17:32:28Z

Backport failed for master, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin master
git worktree add -d .worktree/backport-29752-to-master origin/master
cd .worktree/backport-29752-to-master
git switch --create backport-29752-to-master
git cherry-pick -x 631e186ab043a1d62de837cb5e97cad0973c19f1

lowrisc-ci · 2026-04-17T17:32:56Z

Backport failed for master, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin master
git worktree add -d .worktree/backport-29752-to-master origin/master
cd .worktree/backport-29752-to-master
git switch --create backport-29752-to-master
git cherry-pick -x 631e186ab043a1d62de837cb5e97cad0973c19f1

siemen11 requested a review from a team as a code owner April 12, 2026 11:18

siemen11 requested review from alees24, andrea-caforio, johannheyszl and nasahlpa and removed request for a team and alees24 April 12, 2026 11:18

siemen11 added the CherryPick:master This PR should be cherry-picked to master label Apr 12, 2026

johannheyszl reviewed Apr 13, 2026

View reviewed changes

siemen11 force-pushed the hardened_memory_mod branch 7 times, most recently from facdc57 to 3959c5a Compare April 14, 2026 09:44

siemen11 force-pushed the hardened_memory_mod branch from 3959c5a to a6e253e Compare April 14, 2026 14:42

johannheyszl approved these changes Apr 15, 2026

View reviewed changes

nasahlpa approved these changes Apr 15, 2026

View reviewed changes

siemen11 force-pushed the hardened_memory_mod branch from a6e253e to 5176f80 Compare April 15, 2026 13:17

nasahlpa approved these changes Apr 15, 2026

View reviewed changes

andrea-caforio reviewed Apr 15, 2026

View reviewed changes

siemen11 force-pushed the hardened_memory_mod branch from 5176f80 to 87fc03c Compare April 15, 2026 15:51

andrea-caforio approved these changes Apr 16, 2026

View reviewed changes

siemen11 added the CI:Rerun Rerun failed CI jobs label Apr 16, 2026

github-actions Bot removed the CI:Rerun Rerun failed CI jobs label Apr 16, 2026

siemen11 force-pushed the hardened_memory_mod branch 2 times, most recently from 196f774 to 865e270 Compare April 17, 2026 08:53

siemen11 force-pushed the hardened_memory_mod branch from 865e270 to 631e186 Compare April 17, 2026 12:17

nasahlpa merged commit 367e96d into lowRISC:earlgrey_1.0.0 Apr 17, 2026
37 checks passed

lowrisc-ci Bot added the Manually CherryPick This PR should be manually cherry picked. label Apr 17, 2026

	uint32_t mask = (borrow == 0) * UINT32_MAX;
	uint32_t mask = borrow - 1;

Conversation

siemen11 commented Apr 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

azure-pipelines Bot commented Apr 14, 2026

Uh oh!

johannheyszl left a comment

Choose a reason for hiding this comment

Uh oh!

nasahlpa left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nasahlpa left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lowrisc-ci Bot commented Apr 17, 2026

Uh oh!

lowrisc-ci Bot commented Apr 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants