tornadocontrib/noble-curves
1
0
Fork 0
forked from tornado-packages/noble-curves
Code Pull Requests Activity

ecdsa: remove scalar blinding. CSPRNG dep not good: cryptofuzz, other envs will fail

Browse Source
This commit is contained in:
Paul Miller 2023-02-27 21:48:06 +00:00
parent 11f1626ecc
commit fa5105aef2
No known key found for this signature in database
GPG Key ID: 697079DA6878B89B
1 changed files with 4 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/abstract/weierstrass.ts
View File

@ -943,16 +943,10 @@ export function weierstrass(curveDef: CurveType): CurveFn {
const q = Point.BASE.multiply(k).toAffine(); // q = Gk const q = Point.BASE.multiply(k).toAffine(); // q = Gk
const r = modN(q.x); // r = q.x mod n const r = modN(q.x); // r = q.x mod n
if (r === _0n) return; if (r === _0n) return;
// X blinding according to https://tches.iacr.org/index.php/TCHES/article/view/7337/6509 // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to
// b * m + b * r * d ∈ [0,q−1] exposed via side-channel, but d (private scalar) is not. // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:
// NOTE: there is still probable some leak in multiplication, since it is not constant-time // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT
const b = ut.bytesToNumberBE(utils.randomPrivateKey()); // random scalar, b ∈ [1,q−1] const s = modN(ik * modN(m + r * d)); // Not using blinding here
const bi = invN(b); // b^-1
const bdr = modN(b * d * r); // b * d * r
const bm = modN(b * m); // b * m
const mrx = modN(bi * modN(bdr + bm)); // b^-1(bm + bdr) -> m + rd
const s = modN(ik * mrx); // s = k^-1(m + rd) mod n
if (s === _0n) return; if (s === _0n) return;
let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n) let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n)
let normS = s; let normS = s;