bigint: Provide a fallback implementation for bn_mul_mont.
#1558
Conversation
Provide an implementation of `bn_mul_mont` that works on all targets that don't have an assembly language implementation. Expand `prefixed_export!` to support prefixing functions defined in Rust. Function definitions don't end with a semicolon so move the semicolon insertion from `prefixed_item!` to its callers. Unify the codepaths in `bigint` so that `bn_mul_mont` is always used.
Codecov Report
@@ Coverage Diff @@
## main #1558 +/- ##
==========================================
+ Coverage 92.24% 92.25% +0.01%
==========================================
Files 127 127
Lines 18850 18811 -39
Branches 196 196
==========================================
- Hits 17389 17355 -34
+ Misses 1424 1421 -3
+ Partials 37 35 -2
📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
Take MIPSEL out of the GitHub Actions configuration because it fails to link, and because it makes the build matrix too large.
briansmith
force-pushed
the
b/bn_mul_mont-polyfill
branch
from
d11a58a
to
54520a3
Compare
|
Do you know that the machine code this produces executes in constant time? Can you be sure that future improvements to rustc will maintain those constant time properties? This isn't something that can be tested for or "fuzzed" away. Throwing random test vectors at a routine will give you back white noise timing plots. The sophisticated attacks involve thinking about what kinds of inputs would create carries in certain bit positions, and possibly even using feedback to make those decisions. The necessary countermeasure is to be correct by construction for anything handling raw key material. Chacha20 makes this easy, and it can be done portably for AES if you accept a performance hit. But RSA is a minefield. |
Codes taken from briansmith#1436, briansmith#1558
Codes taken from briansmith#1436, briansmith#1558
Codes taken from briansmith#1436, briansmith#1558
Add an implementation of
bn_mul_mont. Intentionally break the build on big-endian targets so they don't accidentally build/run with incorrect logic. See the individual commit messages for more details. Add mipsel-unknown-linux-gnu to the GitHub Actions test matrix.