authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-01-02 23:37:12+01:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-01-02 23:37:12+01:00
log1bf29757d963b301c1fcfccb9b39b277381de115
tree65857fba4860efebbe6468d924cb37995ae202cb
parent4cee1f7b9a6df9c890268eddc526e66dfa16f0ad
parent1baa127c6561ea604f6250b68b48105d026df575

Merge pull request 'crypto.edwards25519: optimize rejectLowOrder' (#30650) from jedisct1/zig:ed25519rej into master

Reviewed-on: https://codeberg.org/ziglang/zig/pulls/30650

1 files changed, 4 insertions(+), 6 deletions(-)

lib/std/crypto/25519/edwards25519.zig+4-6
...@@ -127,12 +127,10 @@ pub const Edwards25519 = struct {...@@ -127,12 +127,10 @@ pub const Edwards25519 = struct {
127 /// Check that the point does not generate a low-order group.127 /// Check that the point does not generate a low-order group.
128 /// Return a `WeakPublicKey` error if it does.128 /// Return a `WeakPublicKey` error if it does.
129 pub fn rejectLowOrder(p: Edwards25519) WeakPublicKeyError!void {129 pub fn rejectLowOrder(p: Edwards25519) WeakPublicKeyError!void {
130 const zi = p.z.invert();130 const y_sqrtm1 = Fe.sqrtm1.mul(p.y);
131 const x = p.x.mul(zi);131 if (p.x.isZero() or p.y.isZero() or p.z.isZero() or
132 const y = p.y.mul(zi);132 y_sqrtm1.sub(p.x).isZero() or y_sqrtm1.add(p.x).isZero())
133 const x_neg = x.neg();133 {
134 const iy = Fe.sqrtm1.mul(y);
135 if (x.isZero() or y.isZero() or iy.equivalent(x) or iy.equivalent(x_neg)) {
136 return error.WeakPublicKey;134 return error.WeakPublicKey;
137 }135 }
138 }136 }