hare

commit 242b89ecafc7f9ea4a954c5f5cfe0db91bce57d1
parent 5af4fbd5f2f552da47af0f8f765050e49b0ae73f
Author: Drew DeVault <sir@cmpwn.com>
Date:   Tue, 24 May 2022 11:49:19 +0200

crypto::curve25519: clamp input scalar

Signed-off-by: Drew DeVault <sir@cmpwn.com>

Diffstat:
M
crypto/curve25519/+test.ha
 | 
5
+++++
M
crypto/curve25519/curve25519.ha
 | 
23
+++++++++++++----------

2 files changed, 18 insertions(+), 10 deletions(-)
diff --git a/crypto/curve25519/+test.ha b/crypto/curve25519/+test.ha
@@ -184,6 +184,11 @@ use crypto::random;
 		[0xf5, 0xd8, 0xa9, 0x27, 0x90, 0x1d, 0x4f, 0xa4, 0x24, 0x90, 0x86, 0xb7, 0xff, 0xec, 0x24, 0xf5, 0x29, 0x7d, 0x80, 0x11, 0x8e, 0x4a, 0xc9, 0xd3, 0xfc, 0x9a, 0x82, 0x37, 0x95, 0x1e, 0x3b, 0x7f],
 		[0x3c, 0x23, 0x5e, 0xdc, 0x2, 0xf9, 0x11, 0x56, 0x41, 0xdb, 0xf5, 0x16, 0xd5, 0xde, 0x8a, 0x73, 0x5d, 0x6e, 0x53, 0xe2, 0x2a, 0xa2, 0xac, 0x14, 0x36, 0x56, 0x4, 0x5f, 0xf2, 0xe9, 0x52, 0x49],
 		[0xab, 0x95, 0x15, 0xab, 0x14, 0xaf, 0x9d, 0x27, 0xe, 0x1d, 0xae, 0xc, 0x56, 0x80, 0xcb, 0xc8, 0x88, 0xb, 0xd8, 0xa8, 0xe7, 0xeb, 0x67, 0xb4, 0xda, 0x42, 0xa6, 0x61, 0x96, 0x1e, 0xfc, 0xb],
+	),
+	(
+		[0xa5, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d, 0x3b, 0x16, 0x15, 0x4b, 0x82, 0x46, 0x5e, 0xdd, 0x62, 0x14, 0x4c, 0x0a, 0xc1, 0xfc, 0x5a, 0x18, 0x50, 0x6a, 0x22, 0x44, 0xba, 0x44, 0x9a, 0xc4],
+		[0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb, 0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c, 0x72, 0x66, 0x24, 0xec, 0x26, 0xb3, 0x35, 0x3b, 0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c],
+		[0xc3, 0xda, 0x55, 0x37, 0x9d, 0xe9, 0xc6, 0x90, 0x8e, 0x94, 0xea, 0x4d, 0xf2, 0x8d, 0x08, 0x4f, 0x32, 0xec, 0xcf, 0x03, 0x49, 0x1c, 0x71, 0xf7, 0x54, 0xb4, 0x07, 0x55, 0x77, 0xa2, 0x85, 0x52],
 	)];
 
 	for (let i = 0z; i < len(vectors); i += 1) {
diff --git a/crypto/curve25519/curve25519.ha b/crypto/curve25519/curve25519.ha
@@ -19,6 +19,13 @@ export def POINTSZ: size = 32;
 // The canonical Curve25519 generator
 export const BASEPOINT: [POINTSZ]u8 = [9, 0...];
 
+// An internal representation used for arithmetic operations.
+def FIELDSZ: size = 16;
+type elem = [FIELDSZ]i64;
+
+// Constant used in scalar multiplication.
+const _121665: elem = [0xdb41, 1, 0...];
+
 // Compute the result of the scalar multiplication (scalar * point) and put the
 // result in out.
 export fn x25519(
@@ -51,9 +58,12 @@ export fn scalarmult(
 	scalar: const *[SCALARSZ]u8,
 	point: const *[POINTSZ]u8
 ) void = {
+	let clamped: [SCALARSZ]u8 = *scalar;
+	clamp(&clamped);
+
 	let x = unpack25519(point);
-	let b: elem = *&x;
 	let a: elem = [1, 0...];
+	let b: elem = x;
 	let c: elem = [0...];
 	let d: elem = [1, 0...];
 	let e: elem = [0...];
@@ -61,7 +71,7 @@ export fn scalarmult(
 
 	for (let i = 254i; i >= 0; i -= 1) {
 		let iz = i : size;
-		let bit = ((scalar[iz >> 3] >> (iz & 7)) & 1) : i64;
+		let bit = ((clamped[iz >> 3] >> (iz & 7)) & 1) : i64;
 		swap25519(&a, &b, bit);
 		swap25519(&c, &d, bit);
 		addfe(&e, &a, &c);
@@ -91,18 +101,11 @@ export fn scalarmult(
 	pack25519(out, &a);
 };
 
-// An internal representation used for arithmetic operations.
-def FIELDSZ: size = 16;
-type elem = [FIELDSZ]i64;
-
-// Constant used in scalar multiplication.
-const _121665: elem = [0xdb41, 1, 0...];
-
 fn unpack25519(in: *[SCALARSZ]u8) elem = {
 	let fe: elem = [0...];
 
 	for (let i = 0z; i < FIELDSZ; i += 1) {
-		fe[i] = in[2 * i] : i64 + ((in[2 * i + 1] : i64) << 8);
+		fe[i] = in[2 * i]: i64 + ((in[2 * i + 1]: i64) << 8);
 	};
 	fe[15] &= 0x7fff;