tls: fix the case of sp_256_mont_tpl_10() leaving striay high bits

It has no effect on correctness, but interferes with compating internal state
of different implementations.

function                                             old     new   delta
sp_256_proj_point_dbl_10                             443     451      +8
static.sp_256_mont_sub_10                             46      49      +3
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 2/0 up/down: 11/0)               Total: 11 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

3 files changed, 72 insertions, 11 deletions

diff --git a/networking/tls.c b/networking/tls.c
index 7ae9e5a1f..4f0e2b6eb 100644
--- a/networking/tls.c
+++ b/networking/tls.c
@@ -2326,6 +2326,48 @@ void FAST_FUNC tls_run_copy_loop(tls_state_t *tls, unsigned flags)
 	const int INBUF_STEP = 4 * 1024;
 	struct pollfd pfds[2];
 
+#if 0
+// Debug aid for comparing P256 implementations.
+// Enable this, set SP_DEBUG and FIXED_SECRET to 1,
+// and add
+//	tls_run_copy_loop(NULL, 0);
+// e.g. at the very beginning of wget_main()
+//
+{
+//kbuild:lib-$(CONFIG_TLS) += tls_sp_c32_new.o
+	uint8_t ecc_pub_key32[2 * 32];
+	uint8_t pubkey2x32[2 * 32];
+	uint8_t premaster32[32];
+
+//Fixed input key:
+//	memset(ecc_pub_key32, 0xee, sizeof(ecc_pub_key32));
+//Fixed 000000000000000000000000000000000000ab000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+//	memset(ecc_pub_key32, 0x00, sizeof(ecc_pub_key32));
+//	ecc_pub_key32[18] = 0xab;
+//Random key:
+	tls_get_random(ecc_pub_key32, sizeof(ecc_pub_key32));
+//Biased random (almost all zeros or almost all ones):
+//	srand(time(NULL) ^ getpid());
+//	if (rand() & 1)
+//		memset(ecc_pub_key32, 0x00, sizeof(ecc_pub_key32));
+//	else
+//		memset(ecc_pub_key32, 0xff, sizeof(ecc_pub_key32));
+//	ecc_pub_key32[rand() & 0x3f] = rand();
+
+	xmove_fd(xopen("p256.OLD", O_WRONLY | O_CREAT | O_TRUNC), 2);
+	curve_P256_compute_pubkey_and_premaster(
+			pubkey2x32, premaster32,
+			/*point:*/ ecc_pub_key32
+	);
+	xmove_fd(xopen("p256.NEW", O_WRONLY | O_CREAT | O_TRUNC), 2);
+	curve_P256_compute_pubkey_and_premaster_NEW(
+			pubkey2x32, premaster32,
+			/*point:*/ ecc_pub_key32
+	);
+	exit(1);
+}
+#endif
+
 	pfds[0].fd = STDIN_FILENO;
 	pfds[0].events = POLLIN;
 	pfds[1].fd = tls->ifd;
diff --git a/networking/tls.h b/networking/tls.h
index 215e92b02..eb0fdd4cf 100644
--- a/networking/tls.h
+++ b/networking/tls.h
@@ -117,3 +117,7 @@ void curve_x25519_compute_pubkey_and_premaster(
 void curve_P256_compute_pubkey_and_premaster(
 		uint8_t *pubkey2x32, uint8_t *premaster32,
 		const uint8_t *peerkey2x32) FAST_FUNC;
+
+void curve_P256_compute_pubkey_and_premaster_NEW(
+		uint8_t *pubkey2x32, uint8_t *premaster32,
+		const uint8_t *peerkey2x32) FAST_FUNC;
diff --git a/networking/tls_sp_c32.c b/networking/tls_sp_c32.c
index 99f9c6839..bba22dee3 100644
--- a/networking/tls_sp_c32.c
+++ b/networking/tls_sp_c32.c
@@ -163,11 +163,13 @@ static void dump_512(const char *fmt, const sp_digit* cr)
 	a[j] = 0;
 	for (i = 0; i < 20 && j >= 0; i++) {
 		b = 0;
-		a[j--] |= r[i] << s; b += 8 - s;
+		a[j--] |= r[i] << s;
+		b += 8 - s;
 		if (j < 0)
 			break;
 		while (b < 26) {
-			a[j--] = r[i] >> b; b += 8;
+			a[j--] = r[i] >> b;
+			b += 8;
 			if (j < 0)
 				break;
 		}
@@ -286,9 +288,10 @@ static void sp_256_mont_add_10(sp_digit* r, const sp_digit* a, const sp_digit* b
 {
 	sp_256_add_10(r, a, b);
 	sp_256_norm_10(r);
-	if ((r[9] >> 22) > 0)
+	if ((r[9] >> 22) > 0) {
 		sp_256_sub_10(r, r, m);
-	sp_256_norm_10(r);
+		sp_256_norm_10(r);
+	}
 }
 
 /* Subtract two Montgomery form numbers (r = a - b % m) */
@@ -296,10 +299,12 @@ static void sp_256_mont_sub_10(sp_digit* r, const sp_digit* a, const sp_digit* b
 		const sp_digit* m)
 {
 	sp_256_sub_10(r, a, b);
-	if (r[9] >> 22)
-		sp_256_add_10(r, r, m);
 	sp_256_norm_10(r);
-	r[9] &= 0x03fffff; /* truncate to 22 bits */
+	if (r[9] >> 22) {
+		sp_256_add_10(r, r, m);
+		sp_256_norm_10(r);
+		r[9] &= 0x03fffff; /* truncate to 22 bits */
+	}
 }
 
 /* Double a Montgomery form number (r = a + a % m) */
@@ -317,14 +322,17 @@ static void sp_256_mont_tpl_10(sp_digit* r, const sp_digit* a, const sp_digit* m
 {
 	sp_256_add_10(r, a, a);
 	sp_256_norm_10(r);
-	if ((r[9] >> 22) > 0)
+	if ((r[9] >> 22) > 0) {
 		sp_256_sub_10(r, r, m);
-	sp_256_norm_10(r);
+		sp_256_norm_10(r);
+	}
 	sp_256_add_10(r, r, a);
 	sp_256_norm_10(r);
-	if ((r[9] >> 22) > 0)
+	if ((r[9] >> 22) > 0) {
 		sp_256_sub_10(r, r, m);
-	sp_256_norm_10(r);
+		sp_256_norm_10(r);
+	}
+	r[9] &= 0x03fffff; /* truncate to 22 bits */
 }
 
 /* Shift the result in the high 256 bits down to the bottom. */
@@ -650,6 +658,13 @@ static void sp_256_proj_point_dbl_10(sp_point* r, sp_point* p)
 	if (r->infinity) /* If infinity, don't double */
 		return;
 
+	if (SP_DEBUG) {
+		/* unused part of t2, may result in spurios
+		 * differences in debug output. Clear it.
+		 */
+		memset(t2, 0, sizeof(t2));
+	}
+
 	/* T1 = Z * Z */
 	sp_256_mont_sqr_10(t1, r->z /*, p256_mod, p256_mp_mod*/);
 	/* Z = Y * Z */