P-384/521 fallback to small implementation when OPENSSL_SMALL is set

[dkostic]

Issues:

N/A

Description of changes:

We should use the generic EC_GFp_mont_method for P-384/521 when OPENSSL_SMALL flag is defined.

Call-outs:

Point out areas that need special attention or support during the review process. Discuss architecture or design changes.

Testing:

How is this change tested (unit tests, fuzz tests, etc.)? Are there any testing steps to be verified by the reviewer?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and
the ISC license.

[andrewhop]

What is the size of libcrypto before/after this cahnge? Have you checked that EC_GFp_nistp521_method/EC_GFp_nistp384_method are not in the final library when SMALL is set?

[dkostic]

What is the size of libcrypto before/after this cahnge? Have you checked that EC_GFp_nistp521_method/EC_GFp_nistp384_method are not in the final library when SMALL is set?

good point, I actually didn't guard the implementation in p384/521.c with #if !defined(OPENSSL_SMALL) so it was compiled even though it wasn't used. Fixed that now.

The OPENSSL_SMALL Release build on my M1 mac goes from 8.3MB to 8.0MB.

[nebeid]

The comment in

aws-lc/crypto/ecdh_extra/ecdh_test.cc

Lines 180 to 185 in adea0db

	// The following call converts the point to Montgomery form for P-256/384.
	// For P-224, when the functions from simple.c are used, i.e. when
	// group->meth = EC_GFp_nistp224_method, the coordinate representation
	// is not changed. This is determined based on compile flags in ec.c
	// that are also used below in has_uint128_and_not_small().
	// For P-521, the plain non-Motgomery representation is always used.

needs to be adjusted:

// The following call converts the point to Montgomery form for P-256/384.
// For P-224, when the functions from simple.c are used, i.e. when
// group->meth = EC_GFp_nistp224_method, the coordinate representation
// is not changed. This is determined based on compilation flags in ec.c
// that are duplicated below in is_curve_using_mont_felem_impl().
// For P-521, the plain non-Motgomery representation is always used also except for 
// the flag used in the same function.

Or feel free to edit it to make it clearer.

[dkostic]

fixed.

[nebeid]

Same comment on

aws-lc/crypto/fipsmodule/ec/ec_test.cc

Lines 1891 to 1896 in adea0db

	// The following call converts the point to Montgomery form for P-256/384.
	// For P-224, when the functions from simple.c are used, i.e. when
	// group->meth = EC_GFp_nistp224_method, the coordinate representation
	// is not changed. This is determined based on compile flags in ec.c
	// that are also used below in has_uint128_and_not_small().
	// For P-521, the plain non-Motgomery representation is always used.

as on ecdh_test.cc

[dkostic]

fixed.

[nebeid]

Is this check now a duplicate?

[dkostic]

yes, removed it.