lkml.org 
[lkml]   [2018]   [Nov]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v2] crypto: ecc - regularize scalar for scalar multiplication
On Sun, Nov 11, 2018 at 08:40:02PM +0300, Vitaly Chikunov wrote:
> ecc_point_mult is supposed to be used with a regularized scalar,
> otherwise, it's possible to deduce the position of the top bit of the
> scalar with timing attack. This is important when the scalar is a
> private key.
>
> ecc_point_mult is already using a regular algorithm (i.e. having an
> operation flow independent of the input scalar) but regularization step
> is not implemented.
>
> Arrange scalar to always have fixed top bit by adding a multiple of the
> curve order (n).
>
> References:
> The constant time regularization step is based on micro-ecc by Kenneth
> MacKay and also referenced in the literature (Bernstein, D. J., & Lange,
> T. (2017). Montgomery curves and the Montgomery ladder. (Cryptology
> ePrint Archive; Vol. 2017/293). s.l.: IACR. Chapter 4.6.2.)
>
> Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
> Cc: kernel-hardening@lists.openwall.com
> ---
>
> Changes from v1:
> - No code changes, only description updates to be more informative.
>
> crypto/ecc.c | 16 ++++++++++++----
> 1 file changed, 12 insertions(+), 4 deletions(-)

Patch applied. Thanks.
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

\
 
 \ /
  Last update: 2018-11-16 07:20    [W:0.030 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site