library/constant_time.c - mirror/mbed-tls.git - TrustedFirmware Git Browser

 /**
  *  Constant-time functions
  *
  *  Copyright The Mbed TLS Contributors
  *  SPDX-License-Identifier: Apache-2.0
  *
  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
  *  not use this file except in compliance with the License.
  *  You may obtain a copy of the License at
  *
  *  http://www.apache.org/licenses/LICENSE-2.0
  *
  *  Unless required by applicable law or agreed to in writing, software
  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  *  See the License for the specific language governing permissions and
  *  limitations under the License.
  */

 /*
  * The following functions are implemented without using comparison operators, as those
  * might be translated to branches by some compilers on some platforms.
  */

 #include "common.h"
 #include "constant_time_internal.h"
 #include "mbedtls/constant_time.h"
 #include "mbedtls/error.h"
 #include "mbedtls/platform_util.h"

 #if defined(MBEDTLS_BIGNUM_C)
 #include "mbedtls/bignum.h"
 #include "bignum_core.h"
 #endif

 #if defined(MBEDTLS_SSL_TLS_C)
 #include "ssl_misc.h"
 #endif

 #if defined(MBEDTLS_RSA_C)
 #include "mbedtls/rsa.h"
 #endif

 #if defined(MBEDTLS_BASE64_C)
 #include "constant_time_invasive.h"
 #endif

 #include <string.h>
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
 #define PSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status,    \
                                                            psa_to_ssl_errors,              \
                                                            psa_generic_status_to_mbedtls)
 #endif

 /*
  * Define MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS where assembly is present to
  * perform fast unaligned access to volatile data.
  *
  * This is needed because mbedtls_get_unaligned_uintXX etc don't support volatile
  * memory accesses.
  *
  * Some of these definitions could be moved into alignment.h but for now they are
  * only used here.
  */
 #if defined(MBEDTLS_EFFICIENT_UNALIGNED_ACCESS) && defined(MBEDTLS_HAVE_ASM)
 #if defined(__arm__) || defined(__thumb__) || defined(__thumb2__) || defined(__aarch64__)
 #define MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS
 #endif
 #endif

 #if defined(MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS)
 static inline uint32_t mbedtls_get_unaligned_volatile_uint32(volatile const unsigned char *p)
 {
     /* This is UB, even where it's safe:
      *    return *((volatile uint32_t*)p);
      * so instead the same thing is expressed in assembly below.
      */
     uint32_t r;
 #if defined(__arm__) || defined(__thumb__) || defined(__thumb2__)
     asm volatile ("ldr %0, [%1]" : "=r" (r) : "r" (p) :);
 #elif defined(__aarch64__)
     asm volatile ("ldr %w0, [%1]" : "=r" (r) : "r" (p) :);
 #endif
     return r;
 }
 #endif /* MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS */

 int mbedtls_ct_memcmp(const void *a,
                       const void *b,
                       size_t n)
 {
     size_t i = 0;
     /*
      * `A` and `B` are cast to volatile to ensure that the compiler
      * generates code that always fully reads both buffers.
      * Otherwise it could generate a test to exit early if `diff` has all
      * bits set early in the loop.
      */
     volatile const unsigned char *A = (volatile const unsigned char *) a;
     volatile const unsigned char *B = (volatile const unsigned char *) b;
     uint32_t diff = 0;

 #if defined(MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS)
     for (; (i + 4) <= n; i += 4) {
         uint32_t x = mbedtls_get_unaligned_volatile_uint32(A + i);
         uint32_t y = mbedtls_get_unaligned_volatile_uint32(B + i);
         diff |= x ^ y;
     }
 #endif

     for (; i < n; i++) {
         /* Read volatile data in order before computing diff.
          * This avoids IAR compiler warning:
          * 'the order of volatile accesses is undefined ..' */
         unsigned char x = A[i], y = B[i];
         diff |= x ^ y;
     }

     return (int) diff;
 }

 unsigned mbedtls_ct_uint_mask(unsigned value)
 {
     /* MSVC has a warning about unary minus on unsigned, but this is
      * well-defined and precisely what we want to do here */
 #if defined(_MSC_VER)
 #pragma warning( push )
 #pragma warning( disable : 4146 )
 #endif
     return -((value | -value) >> (sizeof(value) * 8 - 1));
 #if defined(_MSC_VER)
 #pragma warning( pop )
 #endif
 }

 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)

 size_t mbedtls_ct_size_mask(size_t value)
 {
     /* MSVC has a warning about unary minus on unsigned integer types,
      * but this is well-defined and precisely what we want to do here. */
 #if defined(_MSC_VER)
 #pragma warning( push )
 #pragma warning( disable : 4146 )
 #endif
     return -((value | -value) >> (sizeof(value) * 8 - 1));
 #if defined(_MSC_VER)
 #pragma warning( pop )
 #endif
 }

 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */

 #if defined(MBEDTLS_BIGNUM_C)

 mbedtls_mpi_uint mbedtls_ct_mpi_uint_mask(mbedtls_mpi_uint value)
 {
     /* MSVC has a warning about unary minus on unsigned, but this is
      * well-defined and precisely what we want to do here */
 #if defined(_MSC_VER)
 #pragma warning( push )
 #pragma warning( disable : 4146 )
 #endif
     return -((value | -value) >> (sizeof(value) * 8 - 1));
 #if defined(_MSC_VER)
 #pragma warning( pop )
 #endif
 }

 #endif /* MBEDTLS_BIGNUM_C */

 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC)

 /** Constant-flow mask generation for "less than" comparison:
  * - if \p x < \p y, return all-bits 1, that is (size_t) -1
  * - otherwise, return all bits 0, that is 0
  *
  * This function can be used to write constant-time code by replacing branches
  * with bit operations using masks.
  *
  * \param x     The first value to analyze.
  * \param y     The second value to analyze.
  *
  * \return      All-bits-one if \p x is less than \p y, otherwise zero.
  */
 static size_t mbedtls_ct_size_mask_lt(size_t x,
                                       size_t y)
 {
     /* This has the most significant bit set if and only if x < y */
     const size_t sub = x - y;

     /* sub1 = (x < y) ? 1 : 0 */
     const size_t sub1 = sub >> (sizeof(sub) * 8 - 1);

     /* mask = (x < y) ? 0xff... : 0x00... */
     const size_t mask = mbedtls_ct_size_mask(sub1);

     return mask;
 }

 size_t mbedtls_ct_size_mask_ge(size_t x,
                                size_t y)
 {
     return ~mbedtls_ct_size_mask_lt(x, y);
 }

 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC */

 #if defined(MBEDTLS_BASE64_C)

 /* Return 0xff if low <= c <= high, 0 otherwise.
  *
  * Constant flow with respect to c.
  */
 unsigned char mbedtls_ct_uchar_mask_of_range(unsigned char low,
                                              unsigned char high,
                                              unsigned char c)
 {
     /* low_mask is: 0 if low <= c, 0x...ff if low > c */
     unsigned low_mask = ((unsigned) c - low) >> 8;
     /* high_mask is: 0 if c <= high, 0x...ff if c > high */
     unsigned high_mask = ((unsigned) high - c) >> 8;
     return ~(low_mask | high_mask) & 0xff;
 }

 #endif /* MBEDTLS_BASE64_C */

 unsigned mbedtls_ct_size_bool_eq(size_t x,
                                  size_t y)
 {
     /* diff = 0 if x == y, non-zero otherwise */
     const size_t diff = x ^ y;

     /* MSVC has a warning about unary minus on unsigned integer types,
      * but this is well-defined and precisely what we want to do here. */
 #if defined(_MSC_VER)
 #pragma warning( push )
 #pragma warning( disable : 4146 )
 #endif

     /* diff_msb's most significant bit is equal to x != y */
     const size_t diff_msb = (diff | (size_t) -diff);

 #if defined(_MSC_VER)
 #pragma warning( pop )
 #endif

     /* diff1 = (x != y) ? 1 : 0 */
     const unsigned diff1 = diff_msb >> (sizeof(diff_msb) * 8 - 1);

     return 1 ^ diff1;
 }

 #if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT)

 unsigned mbedtls_ct_size_gt(size_t x, size_t y)
 {
     /* Return the sign bit (1 for negative) of (y - x). */
     return (y - x) >> (sizeof(size_t) * 8 - 1);
 }

 #endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C && ! MBEDTLS_RSA_ALT */

 #if defined(MBEDTLS_BIGNUM_C)

 unsigned mbedtls_ct_mpi_uint_lt(const mbedtls_mpi_uint x,
                                 const mbedtls_mpi_uint y)
 {
     mbedtls_mpi_uint ret;
     mbedtls_mpi_uint cond;

     /*
      * Check if the most significant bits (MSB) of the operands are different.
      */
     cond = (x ^ y);
     /*
      * If the MSB are the same then the difference x-y will be negative (and
      * have its MSB set to 1 during conversion to unsigned) if and only if x<y.
      */
     ret = (x - y) & ~cond;
     /*
      * If the MSB are different, then the operand with the MSB of 1 is the
      * bigger. (That is if y has MSB of 1, then x<y is true and it is false if
      * the MSB of y is 0.)
      */
     ret |= y & cond;


     ret = ret >> (sizeof(mbedtls_mpi_uint) * 8 - 1);

     return (unsigned) ret;
 }

 #endif /* MBEDTLS_BIGNUM_C */

 unsigned mbedtls_ct_uint_if(unsigned condition,
                             unsigned if1,
                             unsigned if0)
 {
     unsigned mask = mbedtls_ct_uint_mask(condition);
     return (mask & if1) | (~mask & if0);
 }

 #if defined(MBEDTLS_BIGNUM_C)

 void mbedtls_ct_mpi_uint_cond_assign(size_t n,
                                      mbedtls_mpi_uint *dest,
                                      const mbedtls_mpi_uint *src,
                                      unsigned char condition)
 {
     size_t i;

     /* MSVC has a warning about unary minus on unsigned integer types,
      * but this is well-defined and precisely what we want to do here. */
 #if defined(_MSC_VER)
 #pragma warning( push )
 #pragma warning( disable : 4146 )
 #endif

     /* all-bits 1 if condition is 1, all-bits 0 if condition is 0 */
     const mbedtls_mpi_uint mask = -condition;

 #if defined(_MSC_VER)
 #pragma warning( pop )
 #endif

     for (i = 0; i < n; i++) {
         dest[i] = (src[i] & mask) | (dest[i] & ~mask);
     }
 }

 #endif /* MBEDTLS_BIGNUM_C */

 #if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT)

 void mbedtls_ct_mem_move_to_left(void *start,
                                  size_t total,
                                  size_t offset)
 {
     volatile unsigned char *buf = start;
     size_t i, n;
     if (total == 0) {
         return;
     }
     for (i = 0; i < total; i++) {
         unsigned no_op = mbedtls_ct_size_gt(total - offset, i);
         /* The first `total - offset` passes are a no-op. The last
          * `offset` passes shift the data one byte to the left and
          * zero out the last byte. */
         for (n = 0; n < total - 1; n++) {
             unsigned char current = buf[n];
             unsigned char next = buf[n+1];
             buf[n] = mbedtls_ct_uint_if(no_op, current, next);
         }
         buf[total-1] = mbedtls_ct_uint_if(no_op, buf[total-1], 0);
     }
 }

 #endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C && ! MBEDTLS_RSA_ALT */

 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)

 void mbedtls_ct_memcpy_if_eq(unsigned char *dest,
                              const unsigned char *src,
                              size_t len,
                              size_t c1,
                              size_t c2)
 {
     /* mask = c1 == c2 ? 0xff : 0x00 */
     const size_t equal = mbedtls_ct_size_bool_eq(c1, c2);

     /* dest[i] = c1 == c2 ? src[i] : dest[i] */
     size_t i = 0;
 #if defined(MBEDTLS_EFFICIENT_UNALIGNED_ACCESS)
     const uint32_t mask32 = (uint32_t) mbedtls_ct_size_mask(equal);
     const unsigned char mask = (unsigned char) mask32 & 0xff;

     for (; (i + 4) <= len; i += 4) {
         uint32_t a = mbedtls_get_unaligned_uint32(src  + i) &  mask32;
         uint32_t b = mbedtls_get_unaligned_uint32(dest + i) & ~mask32;
         mbedtls_put_unaligned_uint32(dest + i, a | b);
     }
 #else
     const unsigned char mask = (unsigned char) mbedtls_ct_size_mask(equal);
 #endif /* MBEDTLS_EFFICIENT_UNALIGNED_ACCESS */
     for (; i < len; i++) {
         dest[i] = (src[i] & mask) | (dest[i] & ~mask);
     }
 }

 void mbedtls_ct_memcpy_offset(unsigned char *dest,
                               const unsigned char *src,
                               size_t offset,
                               size_t offset_min,
                               size_t offset_max,
                               size_t len)
 {
     size_t offsetval;

     for (offsetval = offset_min; offsetval <= offset_max; offsetval++) {
         mbedtls_ct_memcpy_if_eq(dest, src + offsetval, len,
                                 offsetval, offset);
     }
 }

 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */

 #if defined(MBEDTLS_BIGNUM_C)

 #define MPI_VALIDATE_RET(cond)                                       \
     MBEDTLS_INTERNAL_VALIDATE_RET(cond, MBEDTLS_ERR_MPI_BAD_INPUT_DATA)

 /*
  * Conditionally assign X = Y, without leaking information
  * about whether the assignment was made or not.
  * (Leaking information about the respective sizes of X and Y is ok however.)
  */
 #if defined(_MSC_VER) && defined(_M_ARM64) && (_MSC_FULL_VER < 193131103)
 /*
  * MSVC miscompiles this function if it's inlined prior to Visual Studio 2022 version 17.1. See:
  * https://developercommunity.visualstudio.com/t/c-compiler-miscompiles-part-of-mbedtls-library-on/1646989
  */
 __declspec(noinline)
 #endif
 int mbedtls_mpi_safe_cond_assign(mbedtls_mpi *X,
                                  const mbedtls_mpi *Y,
                                  unsigned char assign)
 {
     int ret = 0;
     MPI_VALIDATE_RET(X != NULL);
     MPI_VALIDATE_RET(Y != NULL);

     /* all-bits 1 if assign is 1, all-bits 0 if assign is 0 */
     mbedtls_mpi_uint limb_mask = mbedtls_ct_mpi_uint_mask(assign);

     MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n));

     X->s = (int) mbedtls_ct_uint_if(assign, Y->s, X->s);

     mbedtls_mpi_core_cond_assign(X->p, Y->p, Y->n, assign);

     for (size_t i = Y->n; i < X->n; i++) {
         X->p[i] &= ~limb_mask;
     }

 cleanup:
     return ret;
 }

 /*
  * Conditionally swap X and Y, without leaking information
  * about whether the swap was made or not.
  * Here it is not ok to simply swap the pointers, which would lead to
  * different memory access patterns when X and Y are used afterwards.
  */
 int mbedtls_mpi_safe_cond_swap(mbedtls_mpi *X,
                                mbedtls_mpi *Y,
                                unsigned char swap)
 {
     int ret = 0;
     int s;
     MPI_VALIDATE_RET(X != NULL);
     MPI_VALIDATE_RET(Y != NULL);

     if (X == Y) {
         return 0;
     }

     MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n));
     MBEDTLS_MPI_CHK(mbedtls_mpi_grow(Y, X->n));

     s = X->s;
     X->s = (int) mbedtls_ct_uint_if(swap, Y->s, X->s);
     Y->s = (int) mbedtls_ct_uint_if(swap, s, Y->s);

     mbedtls_mpi_core_cond_swap(X->p, Y->p, X->n, swap);

 cleanup:
     return ret;
 }

 /*
  * Compare unsigned values in constant time
  */
 unsigned mbedtls_mpi_core_lt_ct(const mbedtls_mpi_uint *A,
                                 const mbedtls_mpi_uint *B,
                                 size_t limbs)
 {
     unsigned ret, cond, done;

     /* The value of any of these variables is either 0 or 1 for the rest of
      * their scope. */
     ret = cond = done = 0;

     for (size_t i = limbs; i > 0; i--) {
         /*
          * If B[i - 1] < A[i - 1] then A < B is false and the result must
          * remain 0.
          *
          * Again even if we can make a decision, we just mark the result and
          * the fact that we are done and continue looping.
          */
         cond = mbedtls_ct_mpi_uint_lt(B[i - 1], A[i - 1]);
         done |= cond;

         /*
          * If A[i - 1] < B[i - 1] then A < B is true.
          *
          * Again even if we can make a decision, we just mark the result and
          * the fact that we are done and continue looping.
          */
         cond = mbedtls_ct_mpi_uint_lt(A[i - 1], B[i - 1]);
         ret |= cond & (1 - done);
         done |= cond;
     }

     /*
      * If all the limbs were equal, then the numbers are equal, A < B is false
      * and leaving the result 0 is correct.
      */

     return ret;
 }

 /*
  * Compare signed values in constant time
  */
 int mbedtls_mpi_lt_mpi_ct(const mbedtls_mpi *X,
                           const mbedtls_mpi *Y,
                           unsigned *ret)
 {
     size_t i;
     /* The value of any of these variables is either 0 or 1 at all times. */
     unsigned cond, done, X_is_negative, Y_is_negative;

     MPI_VALIDATE_RET(X != NULL);
     MPI_VALIDATE_RET(Y != NULL);
     MPI_VALIDATE_RET(ret != NULL);

     if (X->n != Y->n) {
         return MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
     }

     /*
      * Set sign_N to 1 if N >= 0, 0 if N < 0.
      * We know that N->s == 1 if N >= 0 and N->s == -1 if N < 0.
      */
     X_is_negative = (X->s & 2) >> 1;
     Y_is_negative = (Y->s & 2) >> 1;

     /*
      * If the signs are different, then the positive operand is the bigger.
      * That is if X is negative (X_is_negative == 1), then X < Y is true and it
      * is false if X is positive (X_is_negative == 0).
      */
     cond = (X_is_negative ^ Y_is_negative);
     *ret = cond & X_is_negative;

     /*
      * This is a constant-time function. We might have the result, but we still
      * need to go through the loop. Record if we have the result already.
      */
     done = cond;

     for (i = X->n; i > 0; i--) {
         /*
          * If Y->p[i - 1] < X->p[i - 1] then X < Y is true if and only if both
          * X and Y are negative.
          *
          * Again even if we can make a decision, we just mark the result and
          * the fact that we are done and continue looping.
          */
         cond = mbedtls_ct_mpi_uint_lt(Y->p[i - 1], X->p[i - 1]);
         *ret |= cond & (1 - done) & X_is_negative;
         done |= cond;

         /*
          * If X->p[i - 1] < Y->p[i - 1] then X < Y is true if and only if both
          * X and Y are positive.
          *
          * Again even if we can make a decision, we just mark the result and
          * the fact that we are done and continue looping.
          */
         cond = mbedtls_ct_mpi_uint_lt(X->p[i - 1], Y->p[i - 1]);
         *ret |= cond & (1 - done) & (1 - X_is_negative);
         done |= cond;
     }

     return 0;
 }

 #endif /* MBEDTLS_BIGNUM_C */
	/**
	* Constant-time functions
	*
	* Copyright The Mbed TLS Contributors
	* SPDX-License-Identifier: Apache-2.0
	*
	* Licensed under the Apache License, Version 2.0 (the "License"); you may
	* not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
	* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	/*
	* The following functions are implemented without using comparison operators, as those
	* might be translated to branches by some compilers on some platforms.
	*/

	#include "common.h"
	#include "constant_time_internal.h"
	#include "mbedtls/constant_time.h"
	#include "mbedtls/error.h"
	#include "mbedtls/platform_util.h"

	#if defined(MBEDTLS_BIGNUM_C)
	#include "mbedtls/bignum.h"
	#include "bignum_core.h"
	#endif

	#if defined(MBEDTLS_SSL_TLS_C)
	#include "ssl_misc.h"
	#endif

	#if defined(MBEDTLS_RSA_C)
	#include "mbedtls/rsa.h"
	#endif

	#if defined(MBEDTLS_BASE64_C)
	#include "constant_time_invasive.h"
	#endif

	#include <string.h>
	#if defined(MBEDTLS_USE_PSA_CRYPTO)
	#define PSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status, \
	psa_to_ssl_errors, \
	psa_generic_status_to_mbedtls)
	#endif

	/*
	* Define MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS where assembly is present to
	* perform fast unaligned access to volatile data.
	*
	* This is needed because mbedtls_get_unaligned_uintXX etc don't support volatile
	* memory accesses.
	*
	* Some of these definitions could be moved into alignment.h but for now they are
	* only used here.
	*/
	#if defined(MBEDTLS_EFFICIENT_UNALIGNED_ACCESS) && defined(MBEDTLS_HAVE_ASM)
	#if defined(__arm__) \|\| defined(__thumb__) \|\| defined(__thumb2__) \|\| defined(__aarch64__)
	#define MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS
	#endif
	#endif

	#if defined(MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS)
	static inline uint32_t mbedtls_get_unaligned_volatile_uint32(volatile const unsigned char *p)
	{
	/* This is UB, even where it's safe:
	* return ((volatile uint32_t)p);
	* so instead the same thing is expressed in assembly below.
	*/
	uint32_t r;
	#if defined(__arm__) \|\| defined(__thumb__) \|\| defined(__thumb2__)
	asm volatile ("ldr %0, [%1]" : "=r" (r) : "r" (p) :);
	#elif defined(__aarch64__)
	asm volatile ("ldr %w0, [%1]" : "=r" (r) : "r" (p) :);
	#endif
	return r;
	}
	#endif /* MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS */

	int mbedtls_ct_memcmp(const void *a,
	const void *b,
	size_t n)
	{
	size_t i = 0;
	/*
	* `A` and `B` are cast to volatile to ensure that the compiler
	* generates code that always fully reads both buffers.
	* Otherwise it could generate a test to exit early if `diff` has all
	* bits set early in the loop.
	*/
	volatile const unsigned char A = (volatile const unsigned char ) a;
	volatile const unsigned char B = (volatile const unsigned char ) b;
	uint32_t diff = 0;

	#if defined(MBEDTLS_EFFICIENT_UNALIGNED_VOLATILE_ACCESS)
	for (; (i + 4) <= n; i += 4) {
	uint32_t x = mbedtls_get_unaligned_volatile_uint32(A + i);
	uint32_t y = mbedtls_get_unaligned_volatile_uint32(B + i);
	diff \|= x ^ y;
	}
	#endif

	for (; i < n; i++) {
	/* Read volatile data in order before computing diff.
	* This avoids IAR compiler warning:
	* 'the order of volatile accesses is undefined ..' */
	unsigned char x = A[i], y = B[i];
	diff \|= x ^ y;
	}

	return (int) diff;
	}

	unsigned mbedtls_ct_uint_mask(unsigned value)
	{
	/* MSVC has a warning about unary minus on unsigned, but this is
	* well-defined and precisely what we want to do here */
	#if defined(_MSC_VER)
	#pragma warning( push )
	#pragma warning( disable : 4146 )
	#endif
	return -((value \| -value) >> (sizeof(value) * 8 - 1));
	#if defined(_MSC_VER)
	#pragma warning( pop )
	#endif
	}

	#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)

	size_t mbedtls_ct_size_mask(size_t value)
	{
	/* MSVC has a warning about unary minus on unsigned integer types,
	* but this is well-defined and precisely what we want to do here. */
	#if defined(_MSC_VER)
	#pragma warning( push )
	#pragma warning( disable : 4146 )
	#endif
	return -((value \| -value) >> (sizeof(value) * 8 - 1));
	#if defined(_MSC_VER)
	#pragma warning( pop )
	#endif
	}

	#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */

	#if defined(MBEDTLS_BIGNUM_C)

	mbedtls_mpi_uint mbedtls_ct_mpi_uint_mask(mbedtls_mpi_uint value)
	{
	/* MSVC has a warning about unary minus on unsigned, but this is
	* well-defined and precisely what we want to do here */
	#if defined(_MSC_VER)
	#pragma warning( push )
	#pragma warning( disable : 4146 )
	#endif
	return -((value \| -value) >> (sizeof(value) * 8 - 1));
	#if defined(_MSC_VER)
	#pragma warning( pop )
	#endif
	}

	#endif /* MBEDTLS_BIGNUM_C */

	#if defined(MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC)

	/** Constant-flow mask generation for "less than" comparison:
	* - if \p x < \p y, return all-bits 1, that is (size_t) -1
	* - otherwise, return all bits 0, that is 0
	*
	* This function can be used to write constant-time code by replacing branches
	* with bit operations using masks.
	*
	* \param x The first value to analyze.
	* \param y The second value to analyze.
	*
	* \return All-bits-one if \p x is less than \p y, otherwise zero.
	*/
	static size_t mbedtls_ct_size_mask_lt(size_t x,
	size_t y)
	{
	/* This has the most significant bit set if and only if x < y */
	const size_t sub = x - y;

	/* sub1 = (x < y) ? 1 : 0 */
	const size_t sub1 = sub >> (sizeof(sub) * 8 - 1);

	/* mask = (x < y) ? 0xff... : 0x00... */
	const size_t mask = mbedtls_ct_size_mask(sub1);

	return mask;
	}

	size_t mbedtls_ct_size_mask_ge(size_t x,
	size_t y)
	{
	return ~mbedtls_ct_size_mask_lt(x, y);
	}

	#endif /* MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC */

	#if defined(MBEDTLS_BASE64_C)

	/* Return 0xff if low <= c <= high, 0 otherwise.
	*
	* Constant flow with respect to c.
	*/
	unsigned char mbedtls_ct_uchar_mask_of_range(unsigned char low,
	unsigned char high,
	unsigned char c)
	{
	/* low_mask is: 0 if low <= c, 0x...ff if low > c */
	unsigned low_mask = ((unsigned) c - low) >> 8;
	/* high_mask is: 0 if c <= high, 0x...ff if c > high */
	unsigned high_mask = ((unsigned) high - c) >> 8;
	return ~(low_mask \| high_mask) & 0xff;
	}

	#endif /* MBEDTLS_BASE64_C */

	unsigned mbedtls_ct_size_bool_eq(size_t x,
	size_t y)
	{
	/* diff = 0 if x == y, non-zero otherwise */
	const size_t diff = x ^ y;

	/* MSVC has a warning about unary minus on unsigned integer types,
	* but this is well-defined and precisely what we want to do here. */
	#if defined(_MSC_VER)
	#pragma warning( push )
	#pragma warning( disable : 4146 )
	#endif

	/* diff_msb's most significant bit is equal to x != y */
	const size_t diff_msb = (diff \| (size_t) -diff);

	#if defined(_MSC_VER)
	#pragma warning( pop )
	#endif

	/* diff1 = (x != y) ? 1 : 0 */
	const unsigned diff1 = diff_msb >> (sizeof(diff_msb) * 8 - 1);

	return 1 ^ diff1;
	}

	#if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT)

	unsigned mbedtls_ct_size_gt(size_t x, size_t y)
	{
	/* Return the sign bit (1 for negative) of (y - x). */
	return (y - x) >> (sizeof(size_t) * 8 - 1);
	}

	#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C && ! MBEDTLS_RSA_ALT */

	#if defined(MBEDTLS_BIGNUM_C)

	unsigned mbedtls_ct_mpi_uint_lt(const mbedtls_mpi_uint x,
	const mbedtls_mpi_uint y)
	{
	mbedtls_mpi_uint ret;
	mbedtls_mpi_uint cond;

	/*
	* Check if the most significant bits (MSB) of the operands are different.
	*/
	cond = (x ^ y);
	/*
	* If the MSB are the same then the difference x-y will be negative (and
	* have its MSB set to 1 during conversion to unsigned) if and only if x<y.
	*/
	ret = (x - y) & ~cond;
	/*
	* If the MSB are different, then the operand with the MSB of 1 is the
	* bigger. (That is if y has MSB of 1, then x<y is true and it is false if
	* the MSB of y is 0.)
	*/
	ret \|= y & cond;


	ret = ret >> (sizeof(mbedtls_mpi_uint) * 8 - 1);

	return (unsigned) ret;
	}

	#endif /* MBEDTLS_BIGNUM_C */

	unsigned mbedtls_ct_uint_if(unsigned condition,
	unsigned if1,
	unsigned if0)
	{
	unsigned mask = mbedtls_ct_uint_mask(condition);
	return (mask & if1) \| (~mask & if0);
	}

	#if defined(MBEDTLS_BIGNUM_C)

	void mbedtls_ct_mpi_uint_cond_assign(size_t n,
	mbedtls_mpi_uint *dest,
	const mbedtls_mpi_uint *src,
	unsigned char condition)
	{
	size_t i;

	/* MSVC has a warning about unary minus on unsigned integer types,
	* but this is well-defined and precisely what we want to do here. */
	#if defined(_MSC_VER)
	#pragma warning( push )
	#pragma warning( disable : 4146 )
	#endif

	/* all-bits 1 if condition is 1, all-bits 0 if condition is 0 */
	const mbedtls_mpi_uint mask = -condition;

	#if defined(_MSC_VER)
	#pragma warning( pop )
	#endif

	for (i = 0; i < n; i++) {
	dest[i] = (src[i] & mask) \| (dest[i] & ~mask);
	}
	}

	#endif /* MBEDTLS_BIGNUM_C */

	#if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT)

	void mbedtls_ct_mem_move_to_left(void *start,
	size_t total,
	size_t offset)
	{
	volatile unsigned char *buf = start;
	size_t i, n;
	if (total == 0) {
	return;
	}
	for (i = 0; i < total; i++) {
	unsigned no_op = mbedtls_ct_size_gt(total - offset, i);
	/* The first `total - offset` passes are a no-op. The last
	* `offset` passes shift the data one byte to the left and
	* zero out the last byte. */
	for (n = 0; n < total - 1; n++) {
	unsigned char current = buf[n];
	unsigned char next = buf[n+1];
	buf[n] = mbedtls_ct_uint_if(no_op, current, next);
	}
	buf[total-1] = mbedtls_ct_uint_if(no_op, buf[total-1], 0);
	}
	}

	#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C && ! MBEDTLS_RSA_ALT */

	#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)

	void mbedtls_ct_memcpy_if_eq(unsigned char *dest,
	const unsigned char *src,
	size_t len,
	size_t c1,
	size_t c2)
	{
	/* mask = c1 == c2 ? 0xff : 0x00 */
	const size_t equal = mbedtls_ct_size_bool_eq(c1, c2);

	/* dest[i] = c1 == c2 ? src[i] : dest[i] */
	size_t i = 0;
	#if defined(MBEDTLS_EFFICIENT_UNALIGNED_ACCESS)
	const uint32_t mask32 = (uint32_t) mbedtls_ct_size_mask(equal);
	const unsigned char mask = (unsigned char) mask32 & 0xff;

	for (; (i + 4) <= len; i += 4) {
	uint32_t a = mbedtls_get_unaligned_uint32(src + i) & mask32;
	uint32_t b = mbedtls_get_unaligned_uint32(dest + i) & ~mask32;
	mbedtls_put_unaligned_uint32(dest + i, a \| b);
	}
	#else
	const unsigned char mask = (unsigned char) mbedtls_ct_size_mask(equal);
	#endif /* MBEDTLS_EFFICIENT_UNALIGNED_ACCESS */
	for (; i < len; i++) {
	dest[i] = (src[i] & mask) \| (dest[i] & ~mask);
	}
	}

	void mbedtls_ct_memcpy_offset(unsigned char *dest,
	const unsigned char *src,
	size_t offset,
	size_t offset_min,
	size_t offset_max,
	size_t len)
	{
	size_t offsetval;

	for (offsetval = offset_min; offsetval <= offset_max; offsetval++) {
	mbedtls_ct_memcpy_if_eq(dest, src + offsetval, len,
	offsetval, offset);
	}
	}

	#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */

	#if defined(MBEDTLS_BIGNUM_C)

	#define MPI_VALIDATE_RET(cond) \
	MBEDTLS_INTERNAL_VALIDATE_RET(cond, MBEDTLS_ERR_MPI_BAD_INPUT_DATA)

	/*
	* Conditionally assign X = Y, without leaking information
	* about whether the assignment was made or not.
	* (Leaking information about the respective sizes of X and Y is ok however.)
	*/
	#if defined(_MSC_VER) && defined(_M_ARM64) && (_MSC_FULL_VER < 193131103)
	/*
	* MSVC miscompiles this function if it's inlined prior to Visual Studio 2022 version 17.1. See:
	* https://developercommunity.visualstudio.com/t/c-compiler-miscompiles-part-of-mbedtls-library-on/1646989
	*/
	__declspec(noinline)
	#endif
	int mbedtls_mpi_safe_cond_assign(mbedtls_mpi *X,
	const mbedtls_mpi *Y,
	unsigned char assign)
	{
	int ret = 0;
	MPI_VALIDATE_RET(X != NULL);
	MPI_VALIDATE_RET(Y != NULL);

	/* all-bits 1 if assign is 1, all-bits 0 if assign is 0 */
	mbedtls_mpi_uint limb_mask = mbedtls_ct_mpi_uint_mask(assign);

	MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n));

	X->s = (int) mbedtls_ct_uint_if(assign, Y->s, X->s);

	mbedtls_mpi_core_cond_assign(X->p, Y->p, Y->n, assign);

	for (size_t i = Y->n; i < X->n; i++) {
	X->p[i] &= ~limb_mask;
	}

	cleanup:
	return ret;
	}

	/*
	* Conditionally swap X and Y, without leaking information
	* about whether the swap was made or not.
	* Here it is not ok to simply swap the pointers, which would lead to
	* different memory access patterns when X and Y are used afterwards.
	*/
	int mbedtls_mpi_safe_cond_swap(mbedtls_mpi *X,
	mbedtls_mpi *Y,
	unsigned char swap)
	{
	int ret = 0;
	int s;
	MPI_VALIDATE_RET(X != NULL);
	MPI_VALIDATE_RET(Y != NULL);

	if (X == Y) {
	return 0;
	}

	MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n));
	MBEDTLS_MPI_CHK(mbedtls_mpi_grow(Y, X->n));

	s = X->s;
	X->s = (int) mbedtls_ct_uint_if(swap, Y->s, X->s);
	Y->s = (int) mbedtls_ct_uint_if(swap, s, Y->s);

	mbedtls_mpi_core_cond_swap(X->p, Y->p, X->n, swap);

	cleanup:
	return ret;
	}

	/*
	* Compare unsigned values in constant time
	*/
	unsigned mbedtls_mpi_core_lt_ct(const mbedtls_mpi_uint *A,
	const mbedtls_mpi_uint *B,
	size_t limbs)
	{
	unsigned ret, cond, done;

	/* The value of any of these variables is either 0 or 1 for the rest of
	* their scope. */
	ret = cond = done = 0;

	for (size_t i = limbs; i > 0; i--) {
	/*
	* If B[i - 1] < A[i - 1] then A < B is false and the result must
	* remain 0.
	*
	* Again even if we can make a decision, we just mark the result and
	* the fact that we are done and continue looping.
	*/
	cond = mbedtls_ct_mpi_uint_lt(B[i - 1], A[i - 1]);
	done \|= cond;

	/*
	* If A[i - 1] < B[i - 1] then A < B is true.
	*
	* Again even if we can make a decision, we just mark the result and
	* the fact that we are done and continue looping.
	*/
	cond = mbedtls_ct_mpi_uint_lt(A[i - 1], B[i - 1]);
	ret \|= cond & (1 - done);
	done \|= cond;
	}

	/*
	* If all the limbs were equal, then the numbers are equal, A < B is false
	* and leaving the result 0 is correct.
	*/

	return ret;
	}

	/*
	* Compare signed values in constant time
	*/
	int mbedtls_mpi_lt_mpi_ct(const mbedtls_mpi *X,
	const mbedtls_mpi *Y,
	unsigned *ret)
	{
	size_t i;
	/* The value of any of these variables is either 0 or 1 at all times. */
	unsigned cond, done, X_is_negative, Y_is_negative;

	MPI_VALIDATE_RET(X != NULL);
	MPI_VALIDATE_RET(Y != NULL);
	MPI_VALIDATE_RET(ret != NULL);

	if (X->n != Y->n) {
	return MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
	}

	/*
	* Set sign_N to 1 if N >= 0, 0 if N < 0.
	* We know that N->s == 1 if N >= 0 and N->s == -1 if N < 0.
	*/
	X_is_negative = (X->s & 2) >> 1;
	Y_is_negative = (Y->s & 2) >> 1;

	/*
	* If the signs are different, then the positive operand is the bigger.
	* That is if X is negative (X_is_negative == 1), then X < Y is true and it
	* is false if X is positive (X_is_negative == 0).
	*/
	cond = (X_is_negative ^ Y_is_negative);
	*ret = cond & X_is_negative;

	/*
	* This is a constant-time function. We might have the result, but we still
	* need to go through the loop. Record if we have the result already.
	*/
	done = cond;

	for (i = X->n; i > 0; i--) {
	/*
	* If Y->p[i - 1] < X->p[i - 1] then X < Y is true if and only if both
	* X and Y are negative.
	*
	* Again even if we can make a decision, we just mark the result and
	* the fact that we are done and continue looping.
	*/
	cond = mbedtls_ct_mpi_uint_lt(Y->p[i - 1], X->p[i - 1]);
	*ret \|= cond & (1 - done) & X_is_negative;
	done \|= cond;

	/*
	* If X->p[i - 1] < Y->p[i - 1] then X < Y is true if and only if both
	* X and Y are positive.
	*
	* Again even if we can make a decision, we just mark the result and
	* the fact that we are done and continue looping.
	*/
	cond = mbedtls_ct_mpi_uint_lt(X->p[i - 1], Y->p[i - 1]);
	*ret \|= cond & (1 - done) & (1 - X_is_negative);
	done \|= cond;
	}

	return 0;
	}

	#endif /* MBEDTLS_BIGNUM_C */