Implement RSA signature support for WebAssembly.

Cargo.toml

@@ -47,7 +47,6 @@ include = [
     "crypto/fipsmodule/bn/asm/x86-mont.pl",
     "crypto/fipsmodule/bn/asm/x86_64-mont.pl",
     "crypto/fipsmodule/bn/asm/x86_64-mont5.pl",
-    "crypto/fipsmodule/bn/generic.c",
     "crypto/fipsmodule/bn/internal.h",
     "crypto/fipsmodule/bn/montgomery.c",
     "crypto/fipsmodule/bn/montgomery_inv.c",

build.rs

@@ -55,17 +55,16 @@ const ARM: &str = "arm";
 #[cfg_attr(rustfmt, rustfmt_skip)]
 const RING_SRCS: &[(&[&str], &str)] = &[
     (&[], "crypto/fipsmodule/aes/aes_nohw.c"),
+    (&[], "crypto/fipsmodule/bn/montgomery.c"),
+    (&[], "crypto/fipsmodule/bn/montgomery_inv.c"),
+    (&[], "crypto/limbs/limbs.c"),
     (&[], "crypto/mem.c"),
 
-    (&[AARCH64, ARM, X86_64, X86], "crypto/fipsmodule/bn/generic.c"),
-    (&[AARCH64, ARM, X86_64, X86], "crypto/fipsmodule/bn/montgomery.c"),
-    (&[AARCH64, ARM, X86_64, X86], "crypto/fipsmodule/bn/montgomery_inv.c"),
     (&[AARCH64, ARM, X86_64, X86], "crypto/crypto.c"),
     (&[AARCH64, ARM, X86_64, X86], "crypto/fipsmodule/ec/ecp_nistz.c"),
     (&[AARCH64, ARM, X86_64, X86], "crypto/fipsmodule/ec/ecp_nistz256.c"),
     (&[AARCH64, ARM, X86_64, X86], "crypto/fipsmodule/ec/gfp_p256.c"),
     (&[AARCH64, ARM, X86_64, X86], "crypto/fipsmodule/ec/gfp_p384.c"),
-    (&[AARCH64, ARM, X86_64, X86], "crypto/limbs/limbs.c"),
     (&[AARCH64, ARM, X86_64, X86], "third_party/fiat/curve25519.c"),
 
     (&[X86_64, X86], "crypto/cpu-intel.c"),

crypto/fipsmodule/bn/internal.h

@@ -166,13 +166,6 @@ typedef crypto_word BN_ULONG;
 #endif
 
 
-// bn_mul_add_words multiples |ap| by |w|, adds the result to |rp|, and places
-// the result in |rp|. |ap| and |rp| must both be |num| words long. It returns
-// the carry word of the operation. |ap| and |rp| may be equal but otherwise may
-// not alias.
-BN_ULONG GFp_bn_mul_add_words(BN_ULONG *rp, const BN_ULONG *ap, size_t num,
-                              BN_ULONG w);
-
 // |num| must be at least 4, at least on x86.
 //
 // In other forks, |bn_mul_mont| returns an |int| indicating whether it

crypto/fipsmodule/bn/montgomery.c

@@ -109,6 +109,7 @@
 #include "internal.h"
 #include "../../internal.h"
 
+#include "../../limbs/limbs.h"
 #include "../../limbs/limbs.inl"
 
 OPENSSL_STATIC_ASSERT(BN_MONT_CTX_N0_LIMBS == 1 || BN_MONT_CTX_N0_LIMBS == 2,
@@ -131,7 +132,7 @@ int GFp_bn_from_montgomery_in_place(BN_ULONG r[], size_t num_r, BN_ULONG a[],
   BN_ULONG n0 = n0_[0];
   BN_ULONG carry = 0;
   for (size_t i = 0; i < num_n; i++) {
-    BN_ULONG v = GFp_bn_mul_add_words(a + i, n, num_n, a[i] * n0);
+    BN_ULONG v = GFp_limbs_mul_add_limb(a + i, n, a[i] * n0, num_n);
     v += carry + a[i + num_n];
     carry |= (v != a[i + num_n]);
     carry &= (v <= a[i + num_n]);

crypto/limbs/limbs.c

@@ -15,7 +15,7 @@
 #include "limbs.h"
 
 #include "../internal.h"
-
+#include "../fipsmodule/bn/internal.h"
 #include "limbs.inl"
 
 
@@ -182,3 +182,21 @@ crypto_word LIMBS_window5_unsplit_window(Limb limb, size_t index_within_word) {
 Limb LIMB_shr(Limb a, size_t shift) {
   return a >> shift;
 }
+
+Limb GFp_limbs_mul_add_limb(Limb r[], const Limb a[], Limb b, size_t num_limbs) {
+  Limb carried = 0;
+  for (size_t i = 0; i < num_limbs; ++i) {
+    Limb lo;
+    Limb hi;
+    bn_umult_lohi(&lo, &hi, a[i], b);
+    Limb tmp;
+    Carry c = limb_add(&tmp, lo, carried);
+    c = limb_adc(&carried, hi, 0, c);
+    dev_assert_secret(c == 0);
+    c = limb_add(&r[i], r[i], tmp);
+    c = limb_adc(&carried, carried, 0, c);
+    // (A * B) + C + D never carries.
+    dev_assert_secret(c == 0);
+  }
+  return carried;
+}

crypto/limbs/limbs.h

@@ -36,5 +36,6 @@ void LIMBS_add_mod(Limb r[], const Limb a[], const Limb b[], const Limb m[],
 void LIMBS_sub_mod(Limb r[], const Limb a[], const Limb b[], const Limb m[],
                    size_t num_limbs);
 void LIMBS_shl_mod(Limb r[], const Limb a[], const Limb m[], size_t num_limbs);
+Limb GFp_limbs_mul_add_limb(Limb r[], const Limb a[], Limb b, size_t num_limbs);
 
 #endif /* RING_LIMBS_H */