From 1ea73060bbed6a3153e123c224f3eee67f0373d5 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Fri, 29 May 2026 11:03:57 +0200 Subject: [PATCH] crypto.ff: fix operator priority Exponentiation with short, public exponents doesn't use a precomputation table. Building the table would take more time that it would eventually save. However without explicit parenthesis the test for that parsed as "(public and e.len < 3) or (e.len == 3 and top_byte <= 0x0f)" and not "public and (e.len < 3 or...)" as intended. Not a practical issue since a secret exponent is never going to be short, but we're still supposed to use the constant-time path for non-public exponents. --- lib/std/crypto/ff.zig | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/std/crypto/ff.zig b/lib/std/crypto/ff.zig index caae9cb33e311cd5bee4c21bcdcfd95d4c7bf7f6..796a11e435eed7e956311232b523bf49bf301eb0 100644 --- a/lib/std/crypto/ff.zig +++ b/lib/std/crypto/ff.zig @@ -702,7 +702,9 @@ pub fn Modulus(comptime max_bits: comptime_int) type { var out = self.one(); self.toMontgomery(&out) catch unreachable; - if (public and e.len < 3 or (e.len == 3 and e[if (endian == .big) 0 else 2] <= 0b1111)) { + if (public and + (e.len < 3 or (e.len == 3 and e[if (endian == .big) 0 else 2] <= 0b1111))) + { // Do not use a precomputation table for short, public exponents var x_m = x; if (!x.montgomery) { -- 2.54.0