Added constant_time_select array and entry_from_table

crypto/constant_time_test.cc

@@ -44,6 +44,7 @@
  */
 
 #include "internal.h"
+#include "test/test_util.h"
 
 #include <limits.h>
 #include <stdio.h>
@@ -136,6 +137,35 @@ TEST(ConstantTimeTest, Test) {
       EXPECT_EQ(b, constant_time_select_8(CONSTTIME_FALSE_8, a, b));
     }
   }
+
+  // Test constant_time_select_array_w.
+  crypto_word_t a[256], b[256], c[256];
+  RAND_bytes(reinterpret_cast<uint8_t *>(a), sizeof(a));
+  RAND_bytes(reinterpret_cast<uint8_t *>(b), sizeof(b));
+  RAND_bytes(reinterpret_cast<uint8_t *>(c), sizeof(c));
+
+  constant_time_select_array_w(c, a, b, FromBoolW(true), 256);
+  EXPECT_EQ(0, OPENSSL_memcmp(c, a, sizeof(c)));
+  constant_time_select_array_w(c, a, b, FromBoolW(false), 256);
+  EXPECT_EQ(0, OPENSSL_memcmp(c, b, sizeof(c)));
+
+  // Test constant_time_select_entry_from_table_w.
+  // The table consists of 100 entries, each of size 10 crypto_word_t's.
+  crypto_word_t table[100 * 10];
+  crypto_word_t entry[10];
+  RAND_bytes(reinterpret_cast<uint8_t *>(table), sizeof(table));
+  RAND_bytes(reinterpret_cast<uint8_t *>(entry), sizeof(entry));
+
+  for (size_t i = 0; i < 100; i++) {
+    constant_time_select_entry_from_table_w(entry, table, i, 100, 10);
+    EXPECT_EQ(0, OPENSSL_memcmp(entry, &table[i * 10], sizeof(entry)));
+  }
+
+  // Test that the output remains unchanged when index is out of bounds.
+  crypto_word_t entry_copy[10];
+  OPENSSL_memcpy(entry_copy, entry, sizeof(entry));
+  constant_time_select_entry_from_table_w(entry, table, 101, 100, 10);
+  EXPECT_EQ(0, OPENSSL_memcmp(entry_copy, entry, sizeof(entry)));
 }
 
 TEST(ConstantTimeTest, MemCmp) {

crypto/internal.h

@@ -456,6 +456,27 @@ static inline int constant_time_select_int(crypto_word_t mask, int a, int b) {
                                       (crypto_word_t)(b)));
 }
 
+// constant_time_select_array_w applies |constant_time_select_w| on each
+// corresponding pair of elements of a and b.
+static inline void constant_time_select_array_w(
+        crypto_word_t *c, crypto_word_t *a, crypto_word_t *b,
+        crypto_word_t mask, size_t len) {
+  for (size_t i = 0; i < len; i++) {
+    c[i] = constant_time_select_w(mask, a[i], b[i]);
+  }
+}
+
+// constant_time_select_entry_from_table_w selects the idx-th entry from table.
+static inline void constant_time_select_entry_from_table_w(
+        crypto_word_t *out, crypto_word_t *table,
+        size_t idx, size_t num_entries, size_t entry_size)
+{
+  for (size_t i = 0; i < num_entries; i++) {
+    crypto_word_t mask = constant_time_eq_w(i, idx);
+    constant_time_select_array_w(out, &table[i * entry_size], out, mask, entry_size);
+  }
+}
+
 #if defined(BORINGSSL_CONSTANT_TIME_VALIDATION)
 
 // CONSTTIME_SECRET takes a pointer and a number of bytes and marks that region