authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2022-04-07 10:46:23+02:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2022-04-07 10:46:23+02:00
log93e11b824a37a14fc392bfc64ed8f364f4fc7d46
treed2e956c79107ae159426bb49535978492d84a310
parent289ba5dfc2dbd5f6f179c49e974b0332f16604a6
signature Signed by PGP key 4AEE18F83AFDEB23

crypto/x25519: implement clearCofactor() (#11355)

This is the x25519 counterpart to `edwards25519.clearCofactor()`. It is useful to check for low-order points in protocols where it matters and where clamping cannot work, such as PAKEs.

1 files changed, 7 insertions(+), 4 deletions(-)

lib/std/crypto/25519/curve25519.zig+7-4
...@@ -39,8 +39,11 @@ pub const Curve25519 = struct {...@@ -39,8 +39,11 @@ pub const Curve25519 = struct {
39 }39 }
40 }40 }
4141
42 /// Multiply a point by the cofactor42 /// Multiply a point by the cofactor, returning WeakPublicKey if the element is in a small-order group.
43 pub const clearCofactor = @compileError("TODO what was this function supposed to do? it didn't compile successfully");43 pub fn clearCofactor(p: Curve25519) WeakPublicKeyError!Curve25519 {
44 const cofactor = [_]u8{8} ++ [_]u8{0} ** 31;
45 return ladder(p, cofactor, 4) catch return error.WeakPublicKey;
46 }
4447
45 fn ladder(p: Curve25519, s: [32]u8, comptime bits: usize) IdentityElementError!Curve25519 {48 fn ladder(p: Curve25519, s: [32]u8, comptime bits: usize) IdentityElementError!Curve25519 {
46 var x1 = p.x;49 var x1 = p.x;
...@@ -94,8 +97,7 @@ pub const Curve25519 = struct {...@@ -94,8 +97,7 @@ pub const Curve25519 = struct {
94 /// the identity element or error.WeakPublicKey if the public97 /// the identity element or error.WeakPublicKey if the public
95 /// key is a low-order point.98 /// key is a low-order point.
96 pub fn mul(p: Curve25519, s: [32]u8) (IdentityElementError || WeakPublicKeyError)!Curve25519 {99 pub fn mul(p: Curve25519, s: [32]u8) (IdentityElementError || WeakPublicKeyError)!Curve25519 {
97 const cofactor = [_]u8{8} ++ [_]u8{0} ** 31;100 _ = try p.clearCofactor();
98 _ = ladder(p, cofactor, 4) catch return error.WeakPublicKey;
99 return try ladder(p, s, 256);101 return try ladder(p, s, 256);
100 }102 }
101103
...@@ -148,6 +150,7 @@ test "curve25519 small order check" {...@@ -148,6 +150,7 @@ test "curve25519 small order check" {
148 },150 },
149 };151 };
150 for (small_order_ss) |small_order_s| {152 for (small_order_ss) |small_order_s| {
153 try std.testing.expectError(error.WeakPublicKey, Curve25519.fromBytes(small_order_s).clearCofactor());
151 try std.testing.expectError(error.WeakPublicKey, Curve25519.fromBytes(small_order_s).mul(s));154 try std.testing.expectError(error.WeakPublicKey, Curve25519.fromBytes(small_order_s).mul(s));
152 var extra = small_order_s;155 var extra = small_order_s;
153 extra[31] ^= 0x80;156 extra[31] ^= 0x80;