authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2022-04-07 10:46:23+02:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2022-04-07 10:46:23+02:00
log93e11b824a37a14fc392bfc64ed8f364f4fc7d46
treed2e956c79107ae159426bb49535978492d84a310
parent289ba5dfc2dbd5f6f179c49e974b0332f16604a6
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

crypto/x25519: implement clearCofactor() (#11355)

This is the x25519 counterpart to `edwards25519.clearCofactor()`. It is useful to check for low-order points in protocols where it matters and where clamping cannot work, such as PAKEs.

1 files changed, 7 insertions(+), 4 deletions(-)

lib/std/crypto/25519/curve25519.zig+7-4
......@@ -39,8 +39,11 @@ pub const Curve25519 = struct {
3939 }
4040 }
4141
42 /// Multiply a point by the cofactor
43 pub const clearCofactor = @compileError("TODO what was this function supposed to do? it didn't compile successfully");
42 /// Multiply a point by the cofactor, returning WeakPublicKey if the element is in a small-order group.
43 pub fn clearCofactor(p: Curve25519) WeakPublicKeyError!Curve25519 {
44 const cofactor = [_]u8{8} ++ [_]u8{0} ** 31;
45 return ladder(p, cofactor, 4) catch return error.WeakPublicKey;
46 }
4447
4548 fn ladder(p: Curve25519, s: [32]u8, comptime bits: usize) IdentityElementError!Curve25519 {
4649 var x1 = p.x;
......@@ -94,8 +97,7 @@ pub const Curve25519 = struct {
9497 /// the identity element or error.WeakPublicKey if the public
9598 /// key is a low-order point.
9699 pub fn mul(p: Curve25519, s: [32]u8) (IdentityElementError || WeakPublicKeyError)!Curve25519 {
97 const cofactor = [_]u8{8} ++ [_]u8{0} ** 31;
98 _ = ladder(p, cofactor, 4) catch return error.WeakPublicKey;
100 _ = try p.clearCofactor();
99101 return try ladder(p, s, 256);
100102 }
101103
......@@ -148,6 +150,7 @@ test "curve25519 small order check" {
148150 },
149151 };
150152 for (small_order_ss) |small_order_s| {
153 try std.testing.expectError(error.WeakPublicKey, Curve25519.fromBytes(small_order_s).clearCofactor());
151154 try std.testing.expectError(error.WeakPublicKey, Curve25519.fromBytes(small_order_s).mul(s));
152155 var extra = small_order_s;
153156 extra[31] ^= 0x80;