From eaca8626b270b5c17d686c77220e2aacb5fd908f Mon Sep 17 00:00:00 2001
From: Frank Denis <124872+jedisct1@users.noreply.github.com>
Date: Mon, 11 Mar 2024 09:00:15 +0100
Subject: [PATCH] std.crypto.pcurves fixes (#19245)

Fixes compilation errors in functions that are syntaxic sugar
to operate on serialized scalars.

Also make it explicit that square roots in fields whose size is
not congruent to 3 modulo 4 are not an error, they are just
not implemented yet.

Reported by @vitalonodo - Thanks!
---
 lib/std/crypto/pcurves/common.zig           | 2 +-
 lib/std/crypto/pcurves/p256/scalar.zig      | 4 ++--
 lib/std/crypto/pcurves/p384/scalar.zig      | 4 ++--
 lib/std/crypto/pcurves/secp256k1.zig        | 2 +-
 lib/std/crypto/pcurves/secp256k1/scalar.zig | 4 ++--
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/lib/std/crypto/pcurves/common.zig b/lib/std/crypto/pcurves/common.zig
index ccf40f59ce670afbfa7c3cef9fc9c171fd8612e5..f2c21be8c5b7515a011c82bdcdb4647ed78c9b3f 100644
--- a/lib/std/crypto/pcurves/common.zig
+++ b/lib/std/crypto/pcurves/common.zig
@@ -277,7 +277,7 @@ pub fn Field(comptime params: FieldParams) type {
 
         // x=x2^((field_order+1)/4) w/ field order=3 (mod 4).
         fn uncheckedSqrt(x2: Fe) Fe {
-            comptime debug.assert(field_order % 4 == 3);
+            if (field_order % 4 != 3) @compileError("unimplemented");
             if (field_order == 115792089210356248762697446949407573530086143415290314195533631308867097853951) {
                 const t11 = x2.mul(x2.sq());
                 const t1111 = t11.mul(t11.sqn(2));
diff --git a/lib/std/crypto/pcurves/p256/scalar.zig b/lib/std/crypto/pcurves/p256/scalar.zig
index d7d8ed52565b5f6eccf1a684b6630a6564a6558c..bd071f4b8ba4484b8fb4c6bd43a1c3fb46275f43 100644
--- a/lib/std/crypto/pcurves/p256/scalar.zig
+++ b/lib/std/crypto/pcurves/p256/scalar.zig
@@ -39,7 +39,7 @@ pub fn reduce48(s: [48]u8, endian: std.builtin.Endian) CompressedScalar {
 
 /// Reduce a 64-bytes scalar to the field size.
 pub fn reduce64(s: [64]u8, endian: std.builtin.Endian) CompressedScalar {
-    return ScalarDouble.fromBytes64(s, endian).toBytes(endian);
+    return Scalar.fromBytes64(s, endian).toBytes(endian);
 }
 
 /// Return a*b (mod L)
@@ -160,7 +160,7 @@ pub const Scalar = struct {
     }
 
     /// Return true if n is a quadratic residue mod L.
-    pub fn isSquare(n: Scalar) Scalar {
+    pub fn isSquare(n: Scalar) bool {
         return n.fe.isSquare();
     }
 
diff --git a/lib/std/crypto/pcurves/p384/scalar.zig b/lib/std/crypto/pcurves/p384/scalar.zig
index d29d5ba655bff7c50ae279c625389d6eaf96e043..6ea25f214a4507303a8c24cb82a75aec3a67be69 100644
--- a/lib/std/crypto/pcurves/p384/scalar.zig
+++ b/lib/std/crypto/pcurves/p384/scalar.zig
@@ -34,7 +34,7 @@ pub fn rejectNonCanonical(s: CompressedScalar, endian: std.builtin.Endian) NonCa
 
 /// Reduce a 64-bytes scalar to the field size.
 pub fn reduce64(s: [64]u8, endian: std.builtin.Endian) CompressedScalar {
-    return ScalarDouble.fromBytes64(s, endian).toBytes(endian);
+    return Scalar.fromBytes64(s, endian).toBytes(endian);
 }
 
 /// Return a*b (mod L)
@@ -149,7 +149,7 @@ pub const Scalar = struct {
     }
 
     /// Return true if n is a quadratic residue mod L.
-    pub fn isSquare(n: Scalar) Scalar {
+    pub fn isSquare(n: Scalar) bool {
         return n.fe.isSquare();
     }
 
diff --git a/lib/std/crypto/pcurves/secp256k1.zig b/lib/std/crypto/pcurves/secp256k1.zig
index c2d9e37dfe760186822b82d18f8af9e6f38625cf..945abea931cd206881bb837f251e61d4222067c4 100644
--- a/lib/std/crypto/pcurves/secp256k1.zig
+++ b/lib/std/crypto/pcurves/secp256k1.zig
@@ -221,7 +221,7 @@ pub const Secp256k1 = struct {
         var t0 = p.x.mul(q.x);
         var t1 = p.y.mul(q.y);
         var t3 = q.x.add(q.y);
-        var t4 = p.x.add(p.y1);
+        var t4 = p.x.add(p.y);
         t3 = t3.mul(t4);
         t4 = t0.add(t1);
         t3 = t3.sub(t4);
diff --git a/lib/std/crypto/pcurves/secp256k1/scalar.zig b/lib/std/crypto/pcurves/secp256k1/scalar.zig
index dfb9a7f5e6cb4ea5032dcc1bb93c553aab9fc030..132325026f30e2254b6de1744aaab457f8d47318 100644
--- a/lib/std/crypto/pcurves/secp256k1/scalar.zig
+++ b/lib/std/crypto/pcurves/secp256k1/scalar.zig
@@ -39,7 +39,7 @@ pub fn reduce48(s: [48]u8, endian: std.builtin.Endian) CompressedScalar {
 
 /// Reduce a 64-bytes scalar to the field size.
 pub fn reduce64(s: [64]u8, endian: std.builtin.Endian) CompressedScalar {
-    return ScalarDouble.fromBytes64(s, endian).toBytes(endian);
+    return Scalar.fromBytes64(s, endian).toBytes(endian);
 }
 
 /// Return a*b (mod L)
@@ -160,7 +160,7 @@ pub const Scalar = struct {
     }
 
     /// Return true if n is a quadratic residue mod L.
-    pub fn isSquare(n: Scalar) Scalar {
+    pub fn isSquare(n: Scalar) bool {
         return n.fe.isSquare();
     }
 
-- 
2.54.0