version 1.1.1

ChangeLog

@@ -1,3 +1,31 @@
+2013-12-25  Niibe Yutaka  <gniibe@fsij.org>
+
+	* VERSION: 1.1.1.
+
+	* tool/gnuk_token.py (gnuk_token.__init__, regnual.__init__): Fix
+	the argument of setAltInterface.
+	* tool/gnuk_upgrade.py: Likewise.
+	* tool/dfuse.py (DFU_STM32.__init__): Likewise.
+	* tool/stlinkv2.py (stlinkv2.__init__): Likewise.
+
+2013-12-24  Niibe Yutaka  <gniibe@fsij.org>
+
+	* polarssl/include/polarssl/bn_mul.h (MULADDC_1024_CORE)
+	(MULADDC_1024_LOOP): Use younger number registers more for shorter
+	instructions and better performance.
+	* polarssl/library/bignum.c (mpi_montsqr): Likewise.  Change loop
+	structure and conditional branch for better performance.
+
+2013-12-23  Niibe Yutaka  <gniibe@fsij.org>
+
+	* polarssl/library/bignum.c (mpi_montmul): Computation
+	time should not depends on input.
+	(mpi_montmul, mpi_montred, mpi_montsqr): Change the API.
+	(mpi_exp_mod): Follow the change of the API.  Allocate memory on
+	stack instead of malloc.
+
+	* src/gnuk.ld.in (__process3_stack_size__): Increase stack size.
+
 2013-12-20  Niibe Yutaka  <gniibe@fsij.org>
 
 	* Version 1.1.0.

NEWS

@@ -1,5 +1,17 @@
 Gnuk NEWS - User visible changes
 
+* Major changes in Gnuk 1.1.1
+
+  Released 2013-12-25, by NIIBE Yutaka
+
+** Tools and test suite now work with PyUSB 1.0, too.
+It only worked with PyUSB 0.4.3, but it works with PyUSB 1.0 too.
+
+** Improved RSA routine
+Working memory for RSA computation is taken from stack instead of
+malloc (mostly).
+
+
 * Major changes in Gnuk 1.1.0
 
   Released 2013-12-20, by NIIBE Yutaka

README

@@ -1,18 +1,18 @@
 Gnuk - An Implementation of USB Cryptographic Token for GnuPG
 
-							  Version 1.1.0
-							     2013-12-20
+							  Version 1.1.1
+							     2013-12-25
 							   Niibe Yutaka
 				      Free Software Initiative of Japan
 
 Warning
 =======
 
-This is an experimental release of Gnuk 1.1.0, which has incompatible
-changes to Gnuk 1.0.x.  Specifically, it now supports overriding key
-import, but importing keys (or generating keys) results password
-reset.  Please update your documentation for Gnuk Token, so that the
-instruction of importing keys won't cause any confusion.
+This is another experimental release of Gnuk 1.1.1, which has
+incompatible changes to Gnuk 1.0.x.  Specifically, it now supports
+overriding key import, but importing keys (or generating keys) results
+password reset.  Please update your documentation for Gnuk Token, so
+that the instruction of importing keys won't cause any confusion.
 
 
 What's Gnuk?
@@ -122,9 +122,9 @@ Ac: ST-Link/V2 is cheap one.  We have a tool/stlinkv2.py as flash ROM
 Release notes
 =============
 
-This is an experimental release in version 1.1 series of Gnuk.
+This is another experimental release in version 1.1 series of Gnuk.
 
-While it is daily use for a year and a half, some newly introduced
+While it is daily use for more than two years, some newly introduced
 features (including key generation and firmware upgrade) should be
 considered experimental.
 
@@ -218,7 +218,7 @@ External source code
 
 Gnuk is distributed with external source code.
 
-* chopstx/  -- Chopstx 0.04
+* chopstx/  -- Chopstx 0.03 (+ STBee support)
 
   We use Chopstx as the kernel for Gnuk.
 
@@ -581,10 +581,19 @@ Git Repositories
 
 Please use: http://gitorious.org/gnuk
 
+You can get it by:
+ 
+    $ git clone git://gitorious.org/gnuk/gnuk.git
+
 It's also available at: www.gniibe.org
 You can browse at: http://www.gniibe.org/gitweb?p=gnuk.git;a=summary
 
-We migrated from ChibiOS/RT to Chopstix.  If you have old code of
+I put Chopstx as a submodule of Git.  Please do this:
+
+  $ git submodule init
+  $ git submodule update
+
+We have migrated from ChibiOS/RT to Chopstx.  If you have old code of
 ChibiOS/RT, you need:
 
     Edit .git/config to remove chibios reference

VERSION

@@ -1 +1 @@
-release/1.1.0
+release/1.1.1

doc/development.rst

@@ -38,7 +38,7 @@ You need GNU toolchain and newlib for 'arm-none-eabi' target.
 There is "gcc-arm-embedded" project.  See:
 https://launchpad.net/gcc-arm-embedded/
 
-It is based on GCC 4.7 (as of October, 2013).  We are using "-O3 -Os"
+It is based on GCC 4.8 (as of December, 2013).  We are using "-O3 -Os"
 for compiler option.
 
 

doc/generating-2048-RSA-key.rst

@@ -121,7 +121,7 @@ Then, GnuPG generate keys.  It takes some time.  ::
   Not enough random bytes available.  Please do some other work to give
   the OS a chance to collect more entropy! (Need 15 more bytes)
   ...+++++
-  gpg: key 28C0CD7C marked as ultimately trusted
+  gpg: key 4CA7BABE marked as ultimately trusted
   public and secret key created and signed.
   
   gpg: checking the trustdb

doc/gnuk-keytocard-noremoval.rst

@@ -44,7 +44,6 @@ and type ``1`` to say it's signature key. ::
 
   gpg> keytocard
   Really move the primary key? (y/N) y
-  gpg: detected reader `FSIJ Gnuk (0.12-38FF6A06) 00 00'
   Signature key ....: [none]
   Encryption key....: [none]
   Authentication key: [none]

doc/gnuk-keytocard.rst

@@ -56,7 +56,6 @@ and type ``1`` to say it's signature key. ::
 
   gpg> keytocard
   Really move the primary key? (y/N) y
-  gpg: detected reader `FSIJ Gnuk (0.12-38FF6A06) 00 00'
   Signature key ....: [none]
   Encryption key....: [none]
   Authentication key: [none]

doc/gnuk-passphrase-setting.rst

@@ -28,27 +28,38 @@ Set up PW1, PW3 and reset code
 Invoke GnuPG with the option ``--card-edit``.  ::
 
   $ gpg --card-edit
-  gpg: detected reader `FSIJ Gnuk (0.12-34006E06) 00 00'
   Application ID ...: D276000124010200F517000000010000
   Version ..........: 2.0
   Manufacturer .....: FSIJ
   Serial number ....: 00000001
-  Name of cardholder: [not set]
-  Language prefs ...: [not set]
-  Sex ..............: unspecified
-  URL of public key : [not set]
-  Login data .......: [not set]
-  Signature PIN ....: forced
+  Name of cardholder: Yutaka Niibe
+  Language prefs ...: ja
+  Sex ..............: male
+  URL of public key : http://www.gniibe.org/gniibe.asc
+  Login data .......: gniibe
+  Signature PIN ....: not forced
   Key attributes ...: 2048R 2048R 2048R
   Max. PIN lengths .: 127 127 127
   PIN retry counter : 3 3 3
   Signature counter : 0
-  Signature key ....: [none]
-  Encryption key....: [none]
-  Authentication key: [none]
-  General key info..: [none]
+  Signature key ....: 1241 24BD 3B48 62AF 7A0A  42F1 00B4 5EBD 4CA7 BABE
+        created ....: 2010-10-15 06:46:33
+  Encryption key....: 42E1 E805 4E6F 1F30 26F2  DC79 79A7 9093 0842 39CF
+        created ....: 2010-10-15 06:46:33
+  Authentication key: B4D9 7142 C42D 6802 F5F7  4E70 9C33 B6BA 5BB0 65DC
+        created ....: 2010-10-22 06:06:36
+  General key info..: 
+  pub  2048R/4CA7BABE 2010-10-15 NIIBE Yutaka <gniibe@fsij.org>
+  sec>  2048R/4CA7BABE  created: 2010-10-15  expires: never     
+                        card-no: F517 00000001
+  ssb>  2048R/084239CF  created: 2010-10-15  expires: never     
+                        card-no: F517 00000001
+  ssb>  2048R/5BB065DC  created: 2010-10-22  expires: never     
+                        card-no: F517 00000001
 
-It shows the status of the card (as same as the output of ``gpg --card-status``).  It shows token's name and its USB serial string (0.12-34006E06) from PC/SC-lite.
+  gpg/card> 
+
+It shows the status of the card (as same as the output of ``gpg --card-status``).
 
 Then, GnuPG enters its own command interaction mode.  The prompt is ``gpg/card>``.
 
@@ -83,8 +94,13 @@ please change admin-password at first.
 Then, the token works as same as OpenPGPcard specification
 with regards to PW1 and PW3.)
 
-Lastly, I setup reset code.  This is optional. ::
+Lastly, I setup reset code, entering admin mode.
+Having reset code, you can unblock PIN when the token will be blocked
+(by wrong attempt to entering PIN).  This is optional step. ::
 
+  gpg/card> admin
+  Admin commands are allowed
+  
   gpg/card> passwd
   gpg: OpenPGP card no. D276000124010200F517000000010000 detected
   

doc/gnuk-personalization.rst

@@ -9,11 +9,10 @@ Personalize your Gnuk Token
 Invoke GnuPG with the option ``--card-edit``.  ::
 
   $ gpg --card-edit
-  gpg: detected reader `FSIJ Gnuk (0.12-34006E06) 00 00'
-  Application ID ...: D276000124010200F517000000010000
+  Application ID ...: D276000124010200FFFE330069060000
   Version ..........: 2.0
-  Manufacturer .....: FSIJ
-  Serial number ....: 00000001
+  Manufacturer .....: unmanaged S/N range
+  Serial number ....: 33006906
   Name of cardholder: [not set]
   Language prefs ...: [not set]
   Sex ..............: unspecified
@@ -28,8 +27,10 @@ Invoke GnuPG with the option ``--card-edit``.  ::
   Encryption key....: [none]
   Authentication key: [none]
   General key info..: [none]
+  
+  gpg/card> 
 
-It shows the status of the card (as same as the output of ``gpg --card-status``).  It shows token's name and its USB serial string (0.12-34006E06) from PC/SC-lite.
+It shows the status of the card (as same as the output of ``gpg --card-status``).
 
 Then, GnuPG enters its own command interaction mode.  The prompt is ``gpg/card>``.
 

doc/intro.rst

@@ -51,7 +51,7 @@ Host prerequisites for using Gnuk Token
 
 * [Optional] PC/SC lite (pcscd, libccid)
 
-* SSH: openssh
+* [Optional] SSH: openssh
 
 * [optional] Web: scute, firefox
 

doc/note/HACKING

@@ -5,7 +5,7 @@ It is important to collect enough entropy.  Perhaps, it would
 be possible to get entropy from USB traffic (of other devices).
 
 
-* RSA
+* [Mostly DONE] RSA
 
 It would be good not to use malloc.
 

doc/using-gnuk-token-with-another-computer.rst

@@ -18,7 +18,6 @@ key reference (to the token) in ``.gnupg``.
 To do that, invoke GnuPG with ``--card-edit`` option. ::
 
   $ gpg --card-edit
-  gpg: detected reader `FSIJ Gnuk (0.12-37006A06) 00 00'
   Application ID ...: D276000124010200F517000000010000
   Version ..........: 2.0
   Manufacturer .....: FSIJ

polarssl/include/polarssl/bn_mul.h

@@ -496,64 +496,64 @@
 
 #if defined(__arm__)
 #define MULADDC_1024_CORE                        \
-       "ldmia  %0!, { r5, r6, r7 }  \n\t"        \
-       "ldmia  %1, { r8, r9, r10 }  \n\t"        \
-       "adcs   r8, r8, %2           \n\t"        \
-       "umull  r11, r12, r5, %4     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r8, r8, r11          \n\t"        \
-       "adcs   r9, r9, %2           \n\t"        \
-       "umull  r11, r12, r6, %4     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r9, r9, r11          \n\t"        \
-       "adcs   r10, r10, %2         \n\t"        \
-       "umull  r11, r12, r7, %4     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r10, r10, r11        \n\t"        \
-       "stmia  %1!, { r8, r9, r10 } \n\t"
+       "ldmia  %[s]!, { r8, r9, r10 } \n\t"      \
+       "ldmia  %[d], { r5, r6, r7 }   \n\t"      \
+       "adcs   r5, r5, %[c]           \n\t"      \
+       "umull  r4, r8, r8, %[b]       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r5, r5, r4             \n\t"      \
+       "adcs   r6, r6, %[c]           \n\t"      \
+       "umull  r4, r8, r9, %[b]       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r6, r6, r4             \n\t"      \
+       "adcs   r7, r7, %[c]           \n\t"      \
+       "umull  r4, r8, r10, %[b]      \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r7, r7, r4             \n\t"      \
+       "stmia  %[d]!, { r5, r6, r7 }  \n\t"
 
 #define MULADDC_1024_LOOP                        \
-  asm( "tst    %3, #0xfe0           \n\t"        \
-       "beq    0f                   \n"          \
-"1:	sub    %3, %3, #32          \n\t"        \
-       "ldmia  %0!, { r5, r6, r7 }  \n\t"        \
-       "ldmia  %1, { r8, r9, r10 }  \n\t"        \
-       "adds   r8, r8, %2           \n\t"        \
-       "umull  r11, r12, %4, r5     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r8, r8, r11          \n\t"        \
-       "adcs   r9, r9, %2           \n\t"        \
-       "umull  r11, r12, %4, r6     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r9, r9, r11          \n\t"        \
-       "adcs   r10, r10, %2         \n\t"        \
-       "umull  r11, r12, %4, r7     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r10, r10, r11        \n\t"        \
-       "stmia  %1!, { r8, r9, r10 } \n\t"        \
+  asm( "tst    %[i], #0xfe0           \n\t"      \
+       "beq    0f                     \n"        \
+"1:	ldmia  %[s]!, { r8, r9, r10 } \n\t"      \
+       "ldmia  %[d], { r5, r6, r7 }   \n\t"      \
+       "sub    %[i], %[i], #32        \n\t"      \
+       "adds   r5, r5, %[c]           \n\t"      \
+       "umull  r4, r8, %[b], r8       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r5, r5, r4             \n\t"      \
+       "adcs   r6, r6, %[c]           \n\t"      \
+       "umull  r4, r8, %[b], r9       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r6, r6, r4             \n\t"      \
+       "adcs   r7, r7, %[c]           \n\t"      \
+       "umull  r4, r8, %[b], r10      \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r7, r7, r4             \n\t"      \
+       "stmia  %[d]!, { r5, r6, r7 }  \n\t"      \
        MULADDC_1024_CORE MULADDC_1024_CORE       \
        MULADDC_1024_CORE MULADDC_1024_CORE       \
        MULADDC_1024_CORE MULADDC_1024_CORE       \
        MULADDC_1024_CORE MULADDC_1024_CORE       \
        MULADDC_1024_CORE                         \
-       "ldmia  %0!, { r5, r6 }      \n\t"        \
-       "ldmia  %1, { r8, r9 }       \n\t"        \
-       "adcs   r8, r8, %2           \n\t"        \
-       "umull  r11, r12, %4, r5     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r8, r8, r11          \n\t"        \
-       "adcs   r9, r9, %2           \n\t"        \
-       "umull  r11, r12, %4, r6     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r9, r9, r11          \n\t"        \
-       "stmia  %1!, { r8, r9 }      \n\t"        \
-       "adc    %2, %2, #0           \n\t"        \
-       "tst    %3, #0xfe0           \n\t"        \
-       "bne    1b                   \n"          \
+       "ldmia  %[s]!, { r8, r9 }      \n\t"      \
+       "ldmia  %[d], { r5, r6 }       \n\t"      \
+       "adcs   r5, r5, %[c]           \n\t"      \
+       "umull  r4, r8, %[b], r8       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r5, r5, r4             \n\t"      \
+       "adcs   r6, r6, %[c]           \n\t"      \
+       "umull  r4, r8, %[b], r9       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r6, r6, r4             \n\t"      \
+       "adc    %[c], %[c], #0         \n\t"      \
+       "stmia  %[d]!, { r5, r6 }      \n\t"      \
+       "tst    %[i], #0xfe0           \n\t"      \
+       "bne    1b                     \n"        \
 "0:"                                             \
-       : "=r" (s), "=r" (d), "=r" (c), "=r" (i)       \
-       : "r" (b), "0" (s), "1" (d), "2" (c), "3" (i)  \
-       : "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12", "memory", "cc" );
+       : [s] "=r" (s), [d] "=r" (d), [c] "=r" (c), [i] "=r" (i)    \
+       : [b] "r" (b), "[s]" (s), "[d]" (d), "[c]" (c), "[i]" (i)   \
+       : "r4", "r5", "r6", "r7", "r8", "r9", "r10", "memory", "cc" );
 
 /* Just for reference (dead code) */
 #define MULADDC_HUIT                                   \

polarssl/library/bignum.c

@@ -1382,16 +1382,13 @@ static void mpi_montg_init( t_uint *mm, const mpi *N )
 
 /*
  * Montgomery multiplication: A = A * B * R^-1 mod N  (HAC 14.36)
- * A is placed at the upper half of T.
+ * A is placed at the upper half of D.
  */
-static void mpi_montmul( const mpi *B, const mpi *N, t_uint mm, mpi *T )
+static void mpi_montmul( size_t n, const t_uint *np, t_uint mm, t_uint *d,
+                         const t_uint *bp )
 {
-    size_t i, n, m;
-    t_uint u0, u1, *d, c = 0;
-
-    d = T->p;
-    n = N->n;
-    m = ( B->n < n ) ? B->n : n;
+    size_t i;
+    t_uint u0, u1, c = 0;
 
     for( i = 0; i < n; i++ )
     {
@@ -1400,31 +1397,28 @@ static void mpi_montmul( const mpi *B, const mpi *N, t_uint mm, mpi *T )
          */
         u0 = d[n];
         d[n] = c;
-        u1 = ( d[0] + u0 * B->p[0] ) * mm;
+        u1 = ( d[0] + u0 * bp[0] ) * mm;
 
-        mpi_mul_hlp( m, B->p, d, u0 );
-        c = mpi_mul_hlp( n, N->p, d, u1 );
+        mpi_mul_hlp( n, bp, d, u0 );
+        c = mpi_mul_hlp( n, np, d, u1 );
         d++;
     }
 
     /* prevent timing attacks */
-    if( ((mpi_cmp_abs_limbs ( n, d, N->p ) >= 0) | c) )
-        mpi_sub_hlp( n, N->p, d );
+    if( ((mpi_cmp_abs_limbs ( n, d, np ) >= 0) | c) )
+        mpi_sub_hlp( n, np, d );
     else
-        mpi_sub_hlp( n, T->p, T->p);
+        mpi_sub_hlp( n, d - n, d - n);
 }
 
 /*
  * Montgomery reduction: A = A * R^-1 mod N
- * A is placed at the upper half of T.
+ * A is placed at the upper half of D.
  */
-static void mpi_montred( const mpi *N, t_uint mm, mpi *T )
+static void mpi_montred( size_t n, const t_uint *np, t_uint mm, t_uint *d )
 {
-    size_t i, j, n;
-    t_uint u0, u1, *d, c = 0;
-
-    d = T->p;
-    n = N->n;
+    size_t i, j;
+    t_uint u0, u1, c = 0;
 
     for( i = 0; i < n; i++ )
     {
@@ -1442,116 +1436,106 @@ static void mpi_montred( const mpi *N, t_uint mm, mpi *T )
             d[j] += c; c = ( d[j] < c );
           }
 
-        c = mpi_mul_hlp( n, N->p, d, u1 );
+        c = mpi_mul_hlp( n, np, d, u1 );
         d++;
     }
 
     /* prevent timing attacks */
-    if( ((mpi_cmp_abs_limbs ( n, d, N->p ) >= 0) | c) )
-        mpi_sub_hlp( n, N->p, d );
+    if( ((mpi_cmp_abs_limbs ( n, d, np ) >= 0) | c) )
+        mpi_sub_hlp( n, np, d );
     else
-        mpi_sub_hlp( n, T->p, T->p);
+        mpi_sub_hlp( n, d - n, d - n);
 }
 
 /*
  * Montgomery square: A = A * A * R^-1 mod N
- * A is placed at the upper half of T.
+ * A is placed at the upper half of D.
  */
-static void mpi_montsqr( const mpi *N, t_uint mm, mpi *T )
+static void mpi_montsqr( size_t n, const t_uint *np, t_uint mm, t_uint *d )
 {
-  size_t n, i;
-  t_uint c = 0, *d;
-
-  d = T->p;
-  n = N->n;
+  size_t i;
+  register t_uint c = 0;
 
   for (i = 0; i < n; i++)
     {
       t_uint *wij = &d[i*2];
       t_uint *xj = &d[i+n];
-      t_uint u, x_i;
+      t_uint x_i;
 
       x_i = *xj;
       *xj++ = c;
-      asm ("mov    r8, #0\n\t"  /* R8 := 0, the constant ZERO from here.  */
-           /* (C,U,R9) := w_i_i + x_i*x_i; w_i_i := R9; */
-           "ldr    r9, [%[wij]]\n\t"          /* R9 := w_i_i; */
-           "mov    %[c], r8\n\t"
-           "umull  r11, r12, %[x_i], %[x_i]\n\t"
-           "adds   r9, r9, r11\n\t"
-           "adc    %[u], r8, r12\n\t"
-           "str    r9, [%[wij]], #4\n\t"
+      asm (/* (C,R4,R5) := w_i_i + x_i*x_i; w_i_i := R5; */
+           "mov    %[c], #0\n\t"
+           "ldr    r5, [%[wij]]\n\t"          /* R5 := w_i_i; */
+           "mov    r4, %[c]\n\t"
+           "umlal  r5, r4, %[x_i], %[x_i]\n\t"
+           "str    r5, [%[wij]], #4\n\t"
+           "cmp    %[xj], %[x_max1]\n\t"
+           "bhi    0f\n\t"
+           "mov    r9, %[c]\n\t"  /* R9 := 0, the constant ZERO from here.  */
+           "beq    1f\n"
+   "2:\n\t"
+           "ldmia  %[xj]!, { r7, r8 }\n\t"
+           "ldmia  %[wij], { r5, r6 }\n\t"
+           /* (C,R4,R5) := (C,R4) + w_i_j + 2*x_i*x_j; */
+           "umull  r7, r12, %[x_i], r7\n\t"
+           "adds   r5, r5, r4\n\t"
+           "adc    r4, %[c], r9\n\t"
+           "adds   r5, r5, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], r9, r9\n\t"
+           "adds   r5, r5, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], %[c], r9\n\t"
+           /* (C,R4,R6) := (C,R4) + w_i_j + 2*x_i*x_j; */
+           "adds   r6, r6, r4\n\t"
+           "adc    r4, %[c], r9\n\t"
+           "umull  r7, r12, %[x_i], r8\n\t"
+           "adds   r6, r6, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], r9, r9\n\t"
+           "adds   r6, r6, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], %[c], r9\n\t"
            /**/
-           "subs   r9, %[xj_max], %[xj]\n\t"
-           "bls    1f\n\t"
-           /**/
-           "tst    r9, #4\n\t"
-           "beq    0f\n\t"
-           /* (C,U,R9) := (C,U) + w_i_j + 2*x_i*x_j; */
-           "ldr    r10, [%[xj]], #4\n\t"
-           "ldr    r9, [%[wij]]\n\t"
-           "adds   r9, r9, %[u]\n\t"
-           "adc    %[u], %[c], r8\n\t"
-           "umull  r11, r12, %[x_i], r10\n\t"
-           "adds   r9, r9, r11\n\t"
-           "adcs   %[u], %[u], r12\n\t"
-           "adc    %[c], r8, r8\n\t"
-           "adds   r9, r9, r11\n\t"
-           "adcs   %[u], %[u], r12\n\t"
-           "adc    %[c], %[c], r8\n\t"
-           "str    r9, [%[wij]], #4\n\t"
-           /**/
-           "subs   r9, %[xj_max], %[xj]\n\t"
-           "bls    1f\n"
-   "0:\n\t"
-           "ldmia  %[xj]!, { r6, r7 }\n\t"
-           "ldmia  %[wij], { r9, r10 }\n\t"
-           /* (C,U,R9) := (C,U) + w_i_j + 2*x_i*x_j; */
-           "umull  r11, r12, %[x_i], r6\n\t"
-           "adds   r9, r9, %[u]\n\t"
-           "adc    %[u], %[c], r8\n\t"
-           "adds   r9, r9, r11\n\t"
-           "adcs   %[u], %[u], r12\n\t"
-           "adc    %[c], r8, r8\n\t"
-           "adds   r9, r9, r11\n\t"
-           "adcs   %[u], %[u], r12\n\t"
-           "adc    %[c], %[c], r8\n\t"
-           /* (C,U,R10) := (C,U) + w_i_j + 2*x_i*x_j; */
-           "adds   r10, r10, %[u]\n\t"
-           "adc    %[u], %[c], r8\n\t"
-           "umull  r11, r12, %[x_i], r7\n\t"
-           "adds   r10, r10, r11\n\t"
-           "adcs   %[u], %[u], r12\n\t"
-           "adc    %[c], r8, r8\n\t"
-           "adds   r10, r10, r11\n\t"
-           "adcs   %[u], %[u], r12\n\t"
-           "adc    %[c], %[c], r8\n\t"
-           /**/
-           "stmia  %[wij]!, { r9, r10 }\n\t"
-           /**/
-           "cmp    %[xj], %[xj_max]\n\t"
-           "bcc    0b\n"
+           "stmia  %[wij]!, { r5, r6 }\n\t"
+           "cmp    %[xj], %[x_max1]\n\t"
+           "bcc    2b\n\t"
+           "bne    0f\n"
    "1:\n\t"
-           "ldr    r9, [%[wij]]\n\t"
-           "adds   %[u], %[u], r9\n\t"
-           "adc    %[c], %[c], r8\n\t"
-           "str    %[u], [%[wij]]"
-           : [c] "=&r" (c), [u] "=&r" (u), [wij] "=r" (wij), [xj] "=r" (xj)
-           : [x_i] "r" (x_i), [xj_max] "r" (&d[n*2]),
+           /* (C,R4,R5) := (C,R4) + w_i_j + 2*x_i*x_j; */
+           "ldr    r5, [%[wij]]\n\t"
+           "ldr    r6, [%[xj]], #4\n\t"
+           "adds   r5, r5, r4\n\t"
+           "adc    r4, %[c], r9\n\t"
+           "umull  r7, r12, %[x_i], r6\n\t"
+           "adds   r5, r5, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], r9, r9\n\t"
+           "adds   r5, r5, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], %[c], r9\n\t"
+           "str    r5, [%[wij]], #4\n"
+   "0:\n\t"
+           "ldr    r5, [%[wij]]\n\t"
+           "adds   r4, r4, r5\n\t"
+           "adc    %[c], %[c], #0\n\t"
+           "str    r4, [%[wij]]"
+           : [c] "=&r" (c), [wij] "=r" (wij), [xj] "=r" (xj)
+           : [x_i] "r" (x_i), [x_max1] "r" (&d[n*2-1]),
              "[wij]" (wij), "[xj]" (xj)
-           : "r6", "r7", "r8", "r9", "r10", "r11", "r12", "memory", "cc" );
+           : "r4", "r5", "r6", "r7", "r8", "r9", "r12", "memory", "cc");
 
-        u = d[i] * mm;
-        c += mpi_mul_hlp( n, N->p, &d[i], u );
+        c += mpi_mul_hlp( n, np, &d[i], d[i] * mm );
     }
 
-  d = T->p + n;
+  d += n;
 
   /* prevent timing attacks */
-  if( ((mpi_cmp_abs_limbs ( n, d, N->p ) >= 0) | c) )
-      mpi_sub_hlp( n, N->p, d );
+  if( ((mpi_cmp_abs_limbs ( n, d, np ) >= 0) | c) )
+      mpi_sub_hlp( n, np, d );
   else
-      mpi_sub_hlp( n, T->p, T->p);
+      mpi_sub_hlp( n, d - n, d - n);
 }
 
 /*
@@ -1560,12 +1544,17 @@ static void mpi_montsqr( const mpi *N, t_uint mm, mpi *T )
 int mpi_exp_mod( mpi *X, const mpi *A, const mpi *E, const mpi *N, mpi *_RR )
 {
     int ret;
-    size_t wbits, wsize, one = 1;
-    size_t i, j, nblimbs;
+    size_t i = mpi_msb( E );
+    size_t wsize = ( i > 671 ) ? 6 : ( i > 239 ) ? 5 :
+                   ( i >  79 ) ? 4 : ( i >  23 ) ? 3 : 1;
+    size_t wbits, one = 1;
+    size_t nblimbs;
     size_t bufsize, nbits;
     t_uint ei, mm, state;
-    mpi RR, T, W[ 2 << POLARSSL_MPI_WINDOW_SIZE ], Apos;
-    int neg;
+    mpi RR;
+    t_uint d[N->n*2];
+    t_uint w1[N->n];
+    t_uint wn[(one << (wsize - 1))][N->n];
 
     if( mpi_cmp_int( N, 0 ) < 0 || ( N->p[0] & 1 ) == 0 )
         return( POLARSSL_ERR_MPI_BAD_INPUT_DATA );
@@ -1573,97 +1562,76 @@ int mpi_exp_mod( mpi *X, const mpi *A, const mpi *E, const mpi *N, mpi *_RR )
     if( mpi_cmp_int( E, 0 ) < 0 )
         return( POLARSSL_ERR_MPI_BAD_INPUT_DATA );
 
+    if( A->s == -1 )
+        return( POLARSSL_ERR_MPI_BAD_INPUT_DATA );
+
     /*
      * Init temps and window size
      */
     mpi_montg_init( &mm, N );
-    mpi_init( &RR ); mpi_init( &T );
-    memset( W, 0, sizeof( W ) );
-
-    i = mpi_msb( E );
-
-    wsize = ( i > 671 ) ? 6 : ( i > 239 ) ? 5 :
-            ( i >  79 ) ? 4 : ( i >  23 ) ? 3 : 1;
-
-    if( wsize > POLARSSL_MPI_WINDOW_SIZE )
-        wsize = POLARSSL_MPI_WINDOW_SIZE;
-
-    j = N->n;
     MPI_CHK( mpi_grow( X, N->n ) );
-    MPI_CHK( mpi_grow( &W[1],  N->n ) );
-    MPI_CHK( mpi_grow( &T, N->n * 2 ) ); /* T = 0 here.  */
-
-    /*
-     * Compensate for negative A (and correct at the end)
-     */
-    neg = ( A->s == -1 );
-
-    mpi_init( &Apos );
-    if( neg )
-    {
-        MPI_CHK( mpi_copy( &Apos, A ) );
-        Apos.s = 1;
-        A = &Apos;
-    }
 
     /*
      * If 1st call, pre-compute R^2 mod N
      */
     if( _RR == NULL || _RR->p == NULL )
     {
-        /* T->p is all zero here. */
-        mpi_sub_hlp( N->n, N->p, T.p + N->n);
+        mpi T;
+
+        mpi_init( &RR );
+        T.s = 1; T.n = N->n * 2; T.p = d;
+        memset (d, 0, 2 * N->n * ciL); /* Set D zero. */
+        mpi_sub_hlp( N->n, N->p, d + N->n);
         MPI_CHK( mpi_mod_mpi( &RR, &T, N ) );
 
         if( _RR != NULL )
             memcpy( _RR, &RR, sizeof( mpi ) );
 
-        /* The condition of "the lower half of T is all zero" is kept. */
+        /* The condition of "the lower half of D is all zero" is kept. */
     }
-    else
+    else {
         memcpy( &RR, _RR, sizeof( mpi ) );
+        memset (d, 0, N->n * ciL); /* Set lower half of D zero. */
+    }
 
     /*
      * W[1] = A * R^2 * R^-1 mod N = A * R mod N
      */
-    if( mpi_cmp_mpi( A, N ) >= 0 )
-        mpi_mod_mpi( &W[1], A, N );
-    else   mpi_copy( &W[1], A );
+    if( mpi_cmp_mpi( A, N ) >= 0 ) {
+        mpi W1;
+        W1.s = 1; W1.n = N->n; W1.p = d + N->n;
+        mpi_mod_mpi( &W1, A, N );
+    } else {
+        memset (d + N->n, 0, N->n * ciL);
+        memcpy (d + N->n, A->p, A->n * ciL);
+    }
 
-    memcpy ( T.p + N->n, W[1].p, N->n * ciL);
-    mpi_montmul( &RR, N, mm, &T );
-    memcpy ( W[1].p, T.p + N->n, N->n * ciL);
+    mpi_montmul( N->n, N->p, mm, d, RR.p );
+    memcpy (w1, d + N->n, N->n * ciL);
 
-    if( wsize > 1 )
     {
         /*
          * W[1 << (wsize - 1)] = W[1] ^ ( 2 ^ (wsize - 1) )
          */
-        j =  one << (wsize - 1);
-
-        MPI_CHK( mpi_grow( &W[j], N->n  ) );
-
         for( i = 0; i < wsize - 1; i++ )
-            mpi_montsqr( N, mm, &T );
-        memcpy ( W[j].p, T.p + N->n, N->n * ciL);
+            mpi_montsqr( N->n, N->p, mm, d );
+        memcpy (wn[0], d + N->n, N->n * ciL);
 
         /*
          * W[i] = W[i - 1] * W[1]
          */
-        for( i = j + 1; i < (one << wsize); i++ )
+        for( i = 1; i < (one << (wsize - 1)); i++ )
         {
-            MPI_CHK( mpi_grow( &W[i], N->n      ) );
-
-            mpi_montmul( &W[1], N, mm, &T );
-            memcpy ( W[i].p, T.p + N->n, N->n * ciL);
+            mpi_montmul( N->n, N->p, mm, d, w1 );
+            memcpy (wn[i], d + N->n, N->n * ciL);
         }
     }
 
     /*
      * X = R^2 * R^-1 mod N = R mod N
      */
-    memcpy ( T.p + N->n, RR.p, N->n * ciL);
-    mpi_montred( N, mm, &T );
+    memcpy (d + N->n, RR.p, N->n * ciL);
+    mpi_montred( N->n, N->p, mm, d );
 
     nblimbs = E->n;
     bufsize = 0;
@@ -1696,7 +1664,7 @@ int mpi_exp_mod( mpi *X, const mpi *A, const mpi *E, const mpi *N, mpi *_RR )
             /*
              * out of window, square X
              */
-            mpi_montsqr( N, mm, &T );
+             mpi_montsqr( N->n, N->p, mm, d );
             continue;
         }
 
@@ -1714,12 +1682,12 @@ int mpi_exp_mod( mpi *X, const mpi *A, const mpi *E, const mpi *N, mpi *_RR )
              * X = X^wsize R^-1 mod N
              */
             for( i = 0; i < wsize; i++ )
-                mpi_montsqr( N, mm, &T );
+                mpi_montsqr( N->n, N->p, mm, d );
 
             /*
              * X = X * W[wbits] R^-1 mod N
              */
-            mpi_montmul( &W[wbits], N, mm, &T );
+            mpi_montmul( N->n, N->p, mm, d, wn[wbits - (one << (wsize - 1))]);
 
             state--;
             nbits = 0;
@@ -1732,33 +1700,22 @@ int mpi_exp_mod( mpi *X, const mpi *A, const mpi *E, const mpi *N, mpi *_RR )
      */
     for( i = 0; i < nbits; i++ )
     {
-        mpi_montsqr( N, mm, &T );
+        mpi_montsqr( N->n, N->p, mm, d );
 
         wbits <<= 1;
 
         if( (wbits & (one << wsize)) != 0 )
-            mpi_montmul( &W[1], N, mm, &T );
+            mpi_montmul( N->n, N->p, mm, d, w1);
     }
 
     /*
      * X = A^E * R * R^-1 mod N = A^E mod N
      */
-    mpi_montred( N, mm, &T );
-    memcpy ( X->p, T.p + N->n, N->n * ciL);
-
-    if( neg )
-    {
-        X->s = -1;
-        mpi_add_mpi( X, N, X );
-    }
+    mpi_montred( N->n, N->p, mm, d );
+    memcpy (X->p, d + N->n, N->n * ciL);
 
 cleanup:
 
-    for( i = (one << (wsize - 1)); i < (one << wsize); i++ )
-        mpi_free( &W[i] );
-
-    mpi_free( &W[1] ); mpi_free( &T ); mpi_free( &Apos );
-
     if( _RR == NULL )
         mpi_free( &RR );
 

src/gnuk.ld.in

@@ -5,7 +5,7 @@ __main_stack_size__      = 0x0100;      /* Exception handlers     */
 __process0_stack_size__  = 0x0100;      /* main */
 __process1_stack_size__  = 0x0140;      /* ccid */
 __process2_stack_size__  = 0x0180;      /* rng */
-__process3_stack_size__  = 0x0b00;      /* gpg */
+__process3_stack_size__  = 0x1600;      /* gpg */
 __process4_stack_size__  = 0x0100;      /* intr: usb */
 __process5_stack_size__  = @MSC_SIZE@;  /* msc */
 __process6_stack_size__  = @TIM_SIZE@;  /* intr: timer */

tool/dfuse.py

@@ -111,7 +111,7 @@ class DFU_STM32(object):
         self.__devhandle = device.open()
         self.__devhandle.setConfiguration(configuration)
         self.__devhandle.claimInterface(interface)
-        self.__devhandle.setAltInterface(interface)
+        self.__devhandle.setAltInterface(0)
 
         self.__intf = interface.interfaceNumber
         self.__alt = interface.alternateSetting

tool/gnuk_token.py

@@ -73,7 +73,7 @@ class gnuk_token(object):
         except:
             pass
         self.__devhandle.claimInterface(interface)
-        self.__devhandle.setAltInterface(interface)
+        self.__devhandle.setAltInterface(0)
 
         self.__intf = interface.interfaceNumber
         self.__alt = interface.alternateSetting
@@ -481,7 +481,7 @@ class regnual(object):
         except:
             pass
         self.__devhandle.claimInterface(intf)
-        self.__devhandle.setAltInterface(intf)
+        self.__devhandle.setAltInterface(0)
 
     def mem_info(self):
         mem = self.__devhandle.controlMsg(requestType = 0xc0, request = 0,

tool/gnuk_upgrade.py

@@ -59,7 +59,7 @@ class regnual(object):
         except:
             pass
         self.__devhandle.claimInterface(intf)
-        self.__devhandle.setAltInterface(intf)
+        self.__devhandle.setAltInterface(0)
 
     def mem_info(self):
         mem = self.__devhandle.controlMsg(requestType = 0xc0, request = 0,
@@ -172,7 +172,7 @@ class gnuk_token(object):
         except:
             pass
         self.__devhandle.claimInterface(interface)
-        self.__devhandle.setAltInterface(interface)
+        self.__devhandle.setAltInterface(0)
 
         self.__intf = interface.interfaceNumber
         self.__alt = interface.alternateSetting

tool/stlinkv2.py

@@ -146,7 +146,7 @@ class stlinkv2(object):
         except:
             pass
         self.__devhandle.claimInterface(intf)
-        # self.__devhandle.setAltInterface(intf)  # This is not good for libusb-win32
+        # self.__devhandle.setAltInterface(0)  # This was not good for libusb-win32 with wrong arg intf, new correct value 0 would be OK
 
     def shutdown(self):
         self.__devhandle.releaseInterface()

tool/upgrade_by_passwd.py

@@ -94,7 +94,6 @@ if __name__ == '__main__':
 
     passwd = DEFAULT_PW3
     keyno = 0
-    print sys.argv
     while len(sys.argv) > 3:
         option = sys.argv[1]
         sys.argv.pop(1)