authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2022-06-29 07:43:49+02:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2022-06-29 07:43:49+02:00
logb2e4dda0018b83819c9539609eff7e420eca3202
tree36bf94f2f0ddb83eae2d52632408a2c6ed5714db
parent76546b3f8e19b11f0c88259b1b3e5fd14cfbde31
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

std.crypto.{p256,p384}: process the top nibble in mulDoubleBasePublic (#11956)

Unlike curve25519 where the scalar size is not large enough to fill the top nibble, this can definitely be the case for p256 and p384.

4 files changed, 22 insertions(+), 2 deletions(-)

lib/std/crypto/pcurves/p256.zig+1-1
...@@ -437,7 +437,7 @@ pub const P256 = struct {...@@ -437,7 +437,7 @@ pub const P256 = struct {
437 const e1 = slide(s1);437 const e1 = slide(s1);
438 const e2 = slide(s2);438 const e2 = slide(s2);
439 var q = P256.identityElement;439 var q = P256.identityElement;
440 var pos: usize = 2 * 32 - 1;440 var pos: usize = 2 * 32;
441 while (true) : (pos -= 1) {441 while (true) : (pos -= 1) {
442 const slot1 = e1[pos];442 const slot1 = e1[pos];
443 if (slot1 > 0) {443 if (slot1 > 0) {
lib/std/crypto/pcurves/p384.zig+1-1
...@@ -437,7 +437,7 @@ pub const P384 = struct {...@@ -437,7 +437,7 @@ pub const P384 = struct {
437 const e1 = slide(s1);437 const e1 = slide(s1);
438 const e2 = slide(s2);438 const e2 = slide(s2);
439 var q = P384.identityElement;439 var q = P384.identityElement;
440 var pos: usize = 2 * 48 - 1;440 var pos: usize = 2 * 48;
441 while (true) : (pos -= 1) {441 while (true) : (pos -= 1) {
442 const slot1 = e1[pos];442 const slot1 = e1[pos];
443 if (slot1 > 0) {443 if (slot1 > 0) {
lib/std/crypto/pcurves/tests/p256.zig+10
...@@ -112,6 +112,16 @@ test "p256 double base multiplication" {...@@ -112,6 +112,16 @@ test "p256 double base multiplication" {
112 try testing.expect(pr1.equivalent(pr2));112 try testing.expect(pr1.equivalent(pr2));
113}113}
114114
115test "p256 double base multiplication with large scalars" {
116 const p1 = P256.basePoint;
117 const p2 = P256.basePoint.dbl();
118 const s1 = [_]u8{0xee} ** 32;
119 const s2 = [_]u8{0xdd} ** 32;
120 const pr1 = try P256.mulDoubleBasePublic(p1, s1, p2, s2, .Little);
121 const pr2 = (try p1.mul(s1, .Little)).add(try p2.mul(s2, .Little));
122 try testing.expect(pr1.equivalent(pr2));
123}
124
115test "p256 scalar inverse" {125test "p256 scalar inverse" {
116 const expected = "3b549196a13c898a6f6e84dfb3a22c40a8b9b17fb88e408ea674e451cd01d0a6";126 const expected = "3b549196a13c898a6f6e84dfb3a22c40a8b9b17fb88e408ea674e451cd01d0a6";
117 var out: [32]u8 = undefined;127 var out: [32]u8 = undefined;
lib/std/crypto/pcurves/tests/p384.zig+10
...@@ -115,6 +115,16 @@ test "p384 double base multiplication" {...@@ -115,6 +115,16 @@ test "p384 double base multiplication" {
115 try testing.expect(pr1.equivalent(pr2));115 try testing.expect(pr1.equivalent(pr2));
116}116}
117117
118test "p384 double base multiplication with large scalars" {
119 const p1 = P384.basePoint;
120 const p2 = P384.basePoint.dbl();
121 const s1 = [_]u8{0xee} ** 48;
122 const s2 = [_]u8{0xdd} ** 48;
123 const pr1 = try P384.mulDoubleBasePublic(p1, s1, p2, s2, .Little);
124 const pr2 = (try p1.mul(s1, .Little)).add(try p2.mul(s2, .Little));
125 try testing.expect(pr1.equivalent(pr2));
126}
127
118test "p384 scalar inverse" {128test "p384 scalar inverse" {
119 const expected = "a3cc705f33b5679a66e76ce66e68055c927c5dba531b2837b18fe86119511091b54d733f26b2e7a0f6fa2e7ea21ca806";129 const expected = "a3cc705f33b5679a66e76ce66e68055c927c5dba531b2837b18fe86119511091b54d733f26b2e7a0f6fa2e7ea21ca806";
120 var out: [48]u8 = undefined;130 var out: [48]u8 = undefined;