[openssl-dev] ecp_nistz256 is_one is too liberal with what it considers to be one

[Brian Smith]

Please see the attached program and consider the following change:

```
   if (P256_LIMBS == 8) {
     res |= a[4] ^ ONE[4];
     res |= a[5] ^ ONE[5];
     res |= a[6] ^ ONE[6];
+    res |= a[7] ^ ONE[7];
   }
```

Cheers,
Brian
-- 
https://briansmith.org/

#include <stdint.h>
#include <inttypes.h>
#include <stdio.h>
#include <string.h>

#define BN_BITS2	32
typedef uint32_t BN_ULONG;

#define TOBN(hi, lo) lo, hi

#define P256_LIMBS 8

/* One converted into the Montgomery domain */
static const BN_ULONG ONE[P256_LIMBS] = {
  TOBN(0x00000000, 0x00000001), TOBN(0xffffffff, 0x00000000),
  TOBN(0xffffffff, 0xffffffff), TOBN(0x00000000, 0xfffffffe),
};

static BN_ULONG is_zero(BN_ULONG in)
{
  in |= (0 - in);
  in = ~in;
  in >>= BN_BITS2 - 1;
  return in;
}

static BN_ULONG is_one(const BN_ULONG a[P256_LIMBS])
{
  BN_ULONG res;

  res = a[0] ^ ONE[0];
  res |= a[1] ^ ONE[1];
  res |= a[2] ^ ONE[2];
  res |= a[3] ^ ONE[3];
  if (P256_LIMBS == 8) {
    res |= a[4] ^ ONE[4];
    res |= a[5] ^ ONE[5];
    res |= a[6] ^ ONE[6];
  }

  return is_zero(res);
}

int main() {
  BN_ULONG not_one[P256_LIMBS];
  memcpy(not_one, ONE, sizeof(not_one));
  not_one[7] ^= 1;

  BN_ULONG is_it_one = is_one(not_one);
  printf("%" PRIu32 "\n", is_it_one);
  if (is_it_one) {
    return 1;
  }
  return 0;
}

-- 
openssl-dev mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev