Update montgomery multiplication to use s2n-bignum's verified scalar bignum functions

[aqjune-aws]

Description of changes:

This patch updates aws-lc's montgomery multiplication to use s2n-bignum's verified bignum functions.
This is a follow-up of #1114, and is splitted from #1108.
To selectively apply s2n-bignum to Graviton 2, this patch invokes CRYPTO_is_ARMv8_wide_multiplier_capable() and runs the s2n-bignum functions only when wide multipliers are not capable.

The performance numbers of RSA signing are as follows. Graviton 2 is used, and tool/bssl speed -filter RSA has been used. (Unit: ops/sec).

Bits	Operation	baseline AWS-LC	s2n-bignum	speedup vs baseline
2048	RSA sign	299.3	399	33.31%
	verify (fresh key)	10736.3	15491	44.29%
3072	RSA sign	95.4	113.2	18.66%
	verify (fresh key)	4917.7	6001.7	22.04%
4096	RSA sign	41.7	63.2	51.56%
	verify (fresh key)	2781.6	3451	24.07%

This is only adopted for AArch64 that has narrow multiplication instruction bandwidths.

Testing:

Tested via bssl speed -filter RSA

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[dkostic]

nice improvements, can we get perf numbers for GV3 and possibly Apple M1/M2?

[aqjune-aws]

@dkostic For microarchitectures supporting fast enough multiplications (such as Graviton 3 and M1), the current version of s2n-bignum didn't bring effective performance improvement. To selectively apply s2n-bignum to Graviton 2, this patch invokes CRYPTO_is_ARMv8_wide_multiplier_capable() and runs the s2n-bignum functions only when wide multipliers are not capable.
This is the relevant part in arm_arch.h:

// The Neoverse V1 and Apple M1 micro-architectures are detected to enable
// high unrolling factor of AES-GCM and other algorithms that leverage a
// wide crypto pipeline and fast multiplier.
#define ARMV8_NEOVERSE_V1 (1 << 12)
#define ARMV8_APPLE_M1 (1 << 13)

[aqjune-aws]

From the CI failure, it seems in ARM the s2n-bignum assembly files are not linked to executables if MY_ASSEMBLER_IS_TOO_OLD_FOR_AVX is set.

Relevant CMakeLists.txt lines: https://github.com/aws/aws-lc/blob/main/crypto/fipsmodule/CMakeLists.txt#L170-L171

Should we update the CMakeLists.txt lines in this PR?

=> After a discussion, crypto/fipsmodule/CMakeLists.txt is updated to do so.

[nebeid]

From the CI failure, it seems in ARM the s2n-bignum assembly files are not linked to executables if MY_ASSEMBLER_IS_TOO_OLD_FOR_AVX is set.

Relevant CMakeLists.txt lines: https://github.com/aws/aws-lc/blob/main/crypto/fipsmodule/CMakeLists.txt#L170-L171

Should we update the CMakeLists.txt lines in this PR?

Thank you, aqjune-aws.
I think we always had the same functions from s2n-bignum supported for x86 and aarch64, that’s why we didn’t see this fix.