frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make secp256k1_scalar_add_bit conditional; make secp256k1_scalar_split_lambda_var constant time

Browse Source 
This has the effect of making `secp256k1_scalar_mul_shift_var` constant
time in both input scalars. Keep the _var name because it is NOT constant
time in the shift amount.

As used in `secp256k1_scalar_split_lambda_var`, the shift is always
the constant 272, so this function becomes constant time, and it
loses the `_var` suffix.
This commit is contained in:
Andrew Poelstra
2015-05-22 11:51:51 -05:00
parent 91c0ce95ca
commit ed35d43a0c
7 changed files with 18 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/tests.c
View File

@@ -558,7 +558,10 @@ void scalar_test(void) {
r2 = s1;
if (!secp256k1_scalar_add(&r1, &r1, &b)) {
/* No overflow happened. */
secp256k1_scalar_add_bit(&r2, bit);
secp256k1_scalar_cadd_bit(&r2, bit, 1);
CHECK(secp256k1_scalar_eq(&r1, &r2));
/* cadd is a noop when flag is zero */
secp256k1_scalar_cadd_bit(&r2, bit, 0);
CHECK(secp256k1_scalar_eq(&r1, &r2));
}
}
@@ -1680,7 +1683,7 @@ void test_scalar_split(void) {
unsigned char tmp[32];
random_scalar_order_test(&full);
secp256k1_scalar_split_lambda_var(&s1, &slam, &full);
secp256k1_scalar_split_lambda(&s1, &slam, &full);
/* check that both are <= 128 bits in size */
if (secp256k1_scalar_is_high(&s1))