| author |  Frank Denis <124872+jedisct1@users.noreply.github.com> 2026-05-29 11:03:57+02:00 |
| committer |  Andrew Kelley <andrew@ziglang.org> 2026-05-31 09:37:31+02:00 |
| log | 1ea73060bbed6a3153e123c224f3eee67f0373d5 |
| tree | 77a99d1f01c38d10b77e91a266e6a40f589b137a |
| parent | 99c2792b5e52996c72f7689c347a394bb4a827f3 |
crypto.ff: fix operator priority
Exponentiation with short, public exponents doesn't use a
precomputation table. Building the table would take more time
that it would eventually save.
However without explicit parenthesis the test for that parsed as
"(public and e.len < 3) or (e.len == 3 and top_byte <= 0x0f)"
and not "public and (e.len < 3 or...)" as intended.
Not a practical issue since a secret exponent is never going to be
short, but we're still supposed to use the constant-time path for
non-public exponents.1 files changed, 3 insertions(+), 1 deletions(-)
lib- std
- crypto
lib/std/crypto/ff.zig+3-1
| ... | ... | @@ -702,7 +702,9 @@ pub fn Modulus(comptime max_bits: comptime_int) type { |
| 702 | 702 | var out = self.one(); |
| 703 | 703 | self.toMontgomery(&out) catch unreachable; |
| 704 | 704 | |
| 705 | if (public and e.len < 3 or (e.len == 3 and e[if (endian == .big) 0 else 2] <= 0b1111)) { | |
| 705 | if (public and | |
| 706 | (e.len < 3 or (e.len == 3 and e[if (endian == .big) 0 else 2] <= 0b1111))) | |
| 707 | { | |
| 706 | 708 | // Do not use a precomputation table for short, public exponents |
| 707 | 709 | var x_m = x; |
| 708 | 710 | if (!x.montgomery) { |