fastd/libuecc
1
0
Fork 0
mirror of https://github.com/neocturne/libuecc.git synced 2025-03-04 09:03:31 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix loading of packed points in edge case

Browse source 
The parity bit was not handled correctly when the squeezed value of Y is
not fully reduced.
This commit is contained in:
Matthias Schiffer 2015-10-17 06:29:22 +02:00
parent a20ecf69d8
commit a0751e06dc
1 changed files with 21 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
src/ec25519.c
View file

@ -138,19 +138,20 @@ static void squeeze(uint32_t a[32]) {
a[31] = u; a[31] = u;
} }
static const uint32_t minusp[32] = {
19, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 128
};
/** /**
* Ensures that the output of a previous \ref squeeze is fully reduced * Ensures that the output of a previous \ref squeeze is fully reduced
* *
* After a \ref freeze, only the lower byte of each integer part holds a meaningful value. * After a \ref freeze, only the lower byte of each integer part holds a meaningful value.
*/ */
static void freeze(uint32_t a[32]) { static void freeze(uint32_t a[32]) {
static const uint32_t minusp[32] = {
19, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 128
};
uint32_t aorig[32]; uint32_t aorig[32];
unsigned int j; unsigned int j;
uint32_t negative; uint32_t negative;
@ -164,6 +165,18 @@ static void freeze(uint32_t a[32]) {
a[j] ^= negative & (aorig[j] ^ a[j]); a[j] ^= negative & (aorig[j] ^ a[j]);
} }
/**
* Returns the parity (lowest bit of the fully reduced value) of a
*
* The input must be \em squeezed.
*/
static int parity(uint32_t a[32]) {
uint32_t b[32];
add(b, a, minusp);
return (a[0] ^ (b[31] >> 7) ^ 1) & 1;
}
/** /**
* Multiplies two unpacked integers (modulo p) * Multiplies two unpacked integers (modulo p)
* *
@ -554,7 +567,7 @@ int ecc_25519_load_packed(ecc_25519_work_t *out, const ecc_int256_t *in) {
/* No squeeze is necessary after subtractions from zero if the subtrahend is squeezed */ /* No squeeze is necessary after subtractions from zero if the subtrahend is squeezed */
sub(Yt, zero, Y); sub(Yt, zero, Y);
select(out->Y, Y, Yt, (in->p[31] >> 7) ^ (Y[0] & 1)); select(out->Y, Y, Yt, (in->p[31] >> 7) ^ parity(Y));
mult(out->T, out->X, out->Y); mult(out->T, out->X, out->Y);