authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2023-06-13 20:20:24+02:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2023-06-13 18:20:24+00:00
logcc708b4a880e0077c3fb0a077a8a39104701dc9c
tree833750ae7ff4cd1fba4ab99f647d6538943762f1
parent137b115681c1ca205df27c70422c42460b5aa6ec
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

crypto.pcurves: don't assume that points with X=0 are at infinity (#16017)

There's also a valid point with X=0 on each curves. Fixes #16015

3 files changed, 18 insertions(+), 6 deletions(-)

lib/std/crypto/pcurves/p256.zig+6-2
...@@ -36,7 +36,9 @@ pub const P256 = struct {...@@ -36,7 +36,9 @@ pub const P256 = struct {
3636
37 /// Reject the neutral element.37 /// Reject the neutral element.
38 pub fn rejectIdentity(p: P256) IdentityElementError!void {38 pub fn rejectIdentity(p: P256) IdentityElementError!void {
39 if (p.x.isZero()) {39 const affine_0 = @boolToInt(p.x.equivalent(AffineCoordinates.identityElement.x)) & (@boolToInt(p.y.isZero()) | @boolToInt(p.y.equivalent(AffineCoordinates.identityElement.y)));
40 const is_identity = @boolToInt(p.z.isZero()) | affine_0;
41 if (is_identity != 0) {
40 return error.IdentityElement;42 return error.IdentityElement;
41 }43 }
42 }44 }
...@@ -286,12 +288,14 @@ pub const P256 = struct {...@@ -286,12 +288,14 @@ pub const P256 = struct {
286288
287 /// Return affine coordinates.289 /// Return affine coordinates.
288 pub fn affineCoordinates(p: P256) AffineCoordinates {290 pub fn affineCoordinates(p: P256) AffineCoordinates {
291 const affine_0 = @boolToInt(p.x.equivalent(AffineCoordinates.identityElement.x)) & (@boolToInt(p.y.isZero()) | @boolToInt(p.y.equivalent(AffineCoordinates.identityElement.y)));
292 const is_identity = @boolToInt(p.z.isZero()) | affine_0;
289 const zinv = p.z.invert();293 const zinv = p.z.invert();
290 var ret = AffineCoordinates{294 var ret = AffineCoordinates{
291 .x = p.x.mul(zinv),295 .x = p.x.mul(zinv),
292 .y = p.y.mul(zinv),296 .y = p.y.mul(zinv),
293 };297 };
294 ret.cMov(AffineCoordinates.identityElement, @boolToInt(p.x.isZero()));298 ret.cMov(AffineCoordinates.identityElement, is_identity);
295 return ret;299 return ret;
296 }300 }
297301
lib/std/crypto/pcurves/p384.zig+6-2
...@@ -36,7 +36,9 @@ pub const P384 = struct {...@@ -36,7 +36,9 @@ pub const P384 = struct {
3636
37 /// Reject the neutral element.37 /// Reject the neutral element.
38 pub fn rejectIdentity(p: P384) IdentityElementError!void {38 pub fn rejectIdentity(p: P384) IdentityElementError!void {
39 if (p.x.isZero()) {39 const affine_0 = @boolToInt(p.x.equivalent(AffineCoordinates.identityElement.x)) & (@boolToInt(p.y.isZero()) | @boolToInt(p.y.equivalent(AffineCoordinates.identityElement.y)));
40 const is_identity = @boolToInt(p.z.isZero()) | affine_0;
41 if (is_identity != 0) {
40 return error.IdentityElement;42 return error.IdentityElement;
41 }43 }
42 }44 }
...@@ -286,12 +288,14 @@ pub const P384 = struct {...@@ -286,12 +288,14 @@ pub const P384 = struct {
286288
287 /// Return affine coordinates.289 /// Return affine coordinates.
288 pub fn affineCoordinates(p: P384) AffineCoordinates {290 pub fn affineCoordinates(p: P384) AffineCoordinates {
291 const affine_0 = @boolToInt(p.x.equivalent(AffineCoordinates.identityElement.x)) & (@boolToInt(p.y.isZero()) | @boolToInt(p.y.equivalent(AffineCoordinates.identityElement.y)));
292 const is_identity = @boolToInt(p.z.isZero()) | affine_0;
289 const zinv = p.z.invert();293 const zinv = p.z.invert();
290 var ret = AffineCoordinates{294 var ret = AffineCoordinates{
291 .x = p.x.mul(zinv),295 .x = p.x.mul(zinv),
292 .y = p.y.mul(zinv),296 .y = p.y.mul(zinv),
293 };297 };
294 ret.cMov(AffineCoordinates.identityElement, @boolToInt(p.x.isZero()));298 ret.cMov(AffineCoordinates.identityElement, is_identity);
295 return ret;299 return ret;
296 }300 }
297301
lib/std/crypto/pcurves/secp256k1.zig+6-2
...@@ -89,7 +89,9 @@ pub const Secp256k1 = struct {...@@ -89,7 +89,9 @@ pub const Secp256k1 = struct {
8989
90 /// Reject the neutral element.90 /// Reject the neutral element.
91 pub fn rejectIdentity(p: Secp256k1) IdentityElementError!void {91 pub fn rejectIdentity(p: Secp256k1) IdentityElementError!void {
92 if (p.x.isZero()) {92 const affine_0 = @boolToInt(p.x.equivalent(AffineCoordinates.identityElement.x)) & (@boolToInt(p.y.isZero()) | @boolToInt(p.y.equivalent(AffineCoordinates.identityElement.y)));
93 const is_identity = @boolToInt(p.z.isZero()) | affine_0;
94 if (is_identity != 0) {
93 return error.IdentityElement;95 return error.IdentityElement;
94 }96 }
95 }97 }
...@@ -314,12 +316,14 @@ pub const Secp256k1 = struct {...@@ -314,12 +316,14 @@ pub const Secp256k1 = struct {
314316
315 /// Return affine coordinates.317 /// Return affine coordinates.
316 pub fn affineCoordinates(p: Secp256k1) AffineCoordinates {318 pub fn affineCoordinates(p: Secp256k1) AffineCoordinates {
319 const affine_0 = @boolToInt(p.x.equivalent(AffineCoordinates.identityElement.x)) & (@boolToInt(p.y.isZero()) | @boolToInt(p.y.equivalent(AffineCoordinates.identityElement.y)));
320 const is_identity = @boolToInt(p.z.isZero()) | affine_0;
317 const zinv = p.z.invert();321 const zinv = p.z.invert();
318 var ret = AffineCoordinates{322 var ret = AffineCoordinates{
319 .x = p.x.mul(zinv),323 .x = p.x.mul(zinv),
320 .y = p.y.mul(zinv),324 .y = p.y.mul(zinv),
321 };325 };
322 ret.cMov(AffineCoordinates.identityElement, @boolToInt(p.x.isZero()));326 ret.cMov(AffineCoordinates.identityElement, is_identity);
323 return ret;327 return ret;
324 }328 }
325329