Skip to content

The ct_eq_bytes method produces an invalid Choice #261

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rot256 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

The ct_eq_bytes method produces an invalid Choice #261

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 2 additions & 16 deletions frodo-kem/src/hazmat/traits.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ use crate::hazmat::{
use alloc::{string::String, vec::Vec};
use rand_core::CryptoRng;
use sha3::digest::{ExtendableOutput, ExtendableOutputReset, Update};
use subtle::{Choice, ConditionallySelectable};
use subtle::{Choice, ConditionallySelectable, ConstantTimeEq};
use zeroize::Zeroize;

/// Trait for implementing the FrodoKEM sampling algorithm
Expand Down Expand Up @@ -403,8 +403,7 @@ pub trait Kem: Params + Expanded + Sample {
// Needs to avoid branching on secret data as per:
// Qian Guo, Thomas Johansson, Alexander Nilsson. A key-recovery timing attack on post-quantum
// primitives using the Fujisaki-Okamoto transformation and its application on FrodoKEM. In CRYPTO 2020.
let choice =
self.ct_verify(&matrix_bp, &matrix_bpp) & self.ct_verify(&matrix_c, &matrix_cc);
let choice = matrix_bp.ct_eq(&matrix_bpp) & matrix_c.ct_eq(&matrix_cc);

let mut fin_k = vec![0u8; Self::SHARED_SECRET_LENGTH];
// Take k if choice == 0, otherwise take s
Expand Down Expand Up @@ -769,19 +768,6 @@ pub trait Kem: Params + Expanded + Sample {
}
}

/// Constant time verify for a u16 array
fn ct_verify(&self, a: &[u16], b: &[u16]) -> Choice {
let mut choice = 0;

for i in 0..a.len() {
choice |= a[i] ^ b[i];
}

let mut choice = choice as i16;
choice = ((choice | choice.wrapping_neg()) >> 15) + 1;
Choice::from(choice as u8)
}

/// Constant time select for a u16 array
fn ct_select(&self, choice: Choice, a: &[u8], b: &[u8], out: &mut [u8]) {
for i in 0..a.len() {
Expand Down
16 changes: 1 addition & 15 deletions frodo-kem/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,7 +236,7 @@ macro_rules! ct_eq_imp {
($name:ident) => {
impl ConstantTimeEq for $name {
fn ct_eq(&self, other: &Self) -> Choice {
self.algorithm.ct_eq(&other.algorithm) & ct_eq_bytes(&self.value, &other.value)
self.algorithm.ct_eq(&other.algorithm) & self.value.ct_eq(&other.value)
}
}

Expand Down Expand Up @@ -1644,20 +1644,6 @@ pub struct AlgorithmParams {
pub ciphertext_length: usize,
}

fn ct_eq_bytes(lhs: &[u8], rhs: &[u8]) -> Choice {
if lhs.len() != rhs.len() {
return 0u8.into();
}

let mut eq = 0u8;
for i in 0..lhs.len() {
eq |= lhs[i] ^ rhs[i];
}

let eq = ((eq | eq.wrapping_neg()) >> 7).wrapping_add(1);
Choice::from(eq)
}

#[cfg(test)]
#[allow(clippy::unwrap_used)]
mod tests {
Expand Down