authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-08-14 16:08:26+02:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2020-08-16 22:35:27-07:00
log5f9953f41ff7761cdf86c211c91de7470425771c
tree072d99ed1c9ba08f0e9a8efb46ff4797441d5ef6
parent3f0d80f25eccd12759bad21fb8429e646eff070b

Remove mem.timingSafeEqual() for now

This requires assembly implementations, and is not needed for signature verification. Thanks @daurnimator

2 files changed, 1 insertions(+), 26 deletions(-)

lib/std/crypto/25519/ed25519.zig+1-1
......@@ -96,7 +96,7 @@ pub const Ed25519 = struct {
9696
9797 const p = try a.neg().mul(hram);
9898 const check = (try Curve.basePoint().mul(s.*)).add(p).toBytes();
99 if (mem.timingSafeEqual(u8, &check, r) == false) {
99 if (mem.eql(u8, &check, r) == false) {
100100 return error.InvalidSignature;
101101 }
102102 }
lib/std/mem.zig-25
......@@ -334,31 +334,6 @@ test "mem.secureZero" {
334334 testing.expectEqualSlices(u8, a[0..], b[0..]);
335335}
336336
337/// Constant-time (for a given length) comparison.
338pub fn timingSafeEqual(comptime T: type, a: []const T, b: []const T) bool {
339 const length = a.len;
340 if (length != b.len) {
341 return false;
342 }
343 const ap = @ptrCast([*]const volatile T, a.ptr);
344 const bp = @ptrCast([*]const volatile T, b.ptr);
345 var c: u8 = 0;
346 var i: usize = 0;
347 while (i < length) : (i += 1) {
348 c |= a[i] ^ b[i];
349 }
350 return c == 0;
351}
352
353test "mem.timingSafeEqual" {
354 var a = [_]u8{0xfe} ** 8;
355 var b = [_]u8{0xfe} ** 8;
356
357 testing.expect(timingSafeEqual(u8, &a, &b));
358 a[0] += 1;
359 testing.expect(!timingSafeEqual(u8, &a, &b));
360}
361
362337/// Initializes all fields of the struct with their default value, or zero values if no default value is present.
363338/// If the field is present in the provided initial values, it will have that value instead.
364339/// Structs are initialized recursively.