authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2023-05-27 10:50:57+02:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2023-05-27 08:50:57+00:00
logab37ab33ce94b4fb6536bcc2f3981c0cc257c9f0
treeea6943a107e1753ea7fe6fa5f63badcd49e5d659
parentca16f1e8a703491bcaac0d13379d2556e8ca837d
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

poly1305: properly cast the mask from u1 to u64 (#15869)

Fixes #15855

1 files changed, 11 insertions(+), 2 deletions(-)

lib/std/crypto/poly1305.zig+11-2
...@@ -166,14 +166,14 @@ pub const Poly1305 = struct {...@@ -166,14 +166,14 @@ pub const Poly1305 = struct {
166 var h2 = st.h[2];166 var h2 = st.h[2];
167167
168 // H - (2^130 - 5)168 // H - (2^130 - 5)
169 var v = sub(h0, 0xfffffffffffffffb, 0);169 var v = @subWithOverflow(h0, 0xfffffffffffffffb);
170 const h_p0 = v[0];170 const h_p0 = v[0];
171 v = sub(h1, 0xffffffffffffffff, v[1]);171 v = sub(h1, 0xffffffffffffffff, v[1]);
172 const h_p1 = v[0];172 const h_p1 = v[0];
173 v = sub(h2, 0x0000000000000003, v[1]);173 v = sub(h2, 0x0000000000000003, v[1]);
174174
175 // Final reduction, subtract 2^130-5 from H if H >= 2^130-5175 // Final reduction, subtract 2^130-5 from H if H >= 2^130-5
176 const mask = v[1] -% 1;176 const mask = @as(u64, v[1]) -% 1;
177 h0 ^= mask & (h0 ^ h_p0);177 h0 ^= mask & (h0 ^ h_p0);
178 h1 ^= mask & (h1 ^ h_p1);178 h1 ^= mask & (h1 ^ h_p1);
179179
...@@ -207,3 +207,12 @@ test "poly1305 rfc7439 vector1" {...@@ -207,3 +207,12 @@ test "poly1305 rfc7439 vector1" {
207207
208 try std.testing.expectEqualSlices(u8, expected_mac, &mac);208 try std.testing.expectEqualSlices(u8, expected_mac, &mac);
209}209}
210
211test "poly1305 requiring a final reduction" {
212 const expected_mac = [_]u8{ 25, 13, 249, 42, 164, 57, 99, 60, 149, 181, 74, 74, 13, 63, 121, 6 };
213 const msg = [_]u8{ 253, 193, 249, 146, 70, 6, 214, 226, 131, 213, 241, 116, 20, 24, 210, 224, 65, 151, 255, 104, 133 };
214 const key = [_]u8{ 190, 63, 95, 57, 155, 103, 77, 170, 7, 98, 106, 44, 117, 186, 90, 185, 109, 118, 184, 24, 69, 41, 166, 243, 119, 132, 151, 61, 52, 43, 64, 250 };
215 var mac: [16]u8 = undefined;
216 Poly1305.create(mac[0..], &msg, &key);
217 try std.testing.expectEqualSlices(u8, &expected_mac, &mac);
218}