Repository navigation
Fix CT leaks in CTZ, div_rem, nlimbs, and Montgomery mul - #1360
Merged
Merged
Conversation
tarcieri
force-pushed
the
fix-ct-issues
branch
from
October 23, 2026 01:43
b389543 to
96d77c7
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #1360 +/- ##
==========================================
+ Coverage 91.30% 91.32% +0.01%
==========================================
Files 190 190
Lines 22976 22982 +6
==========================================
+ Hits 20979 20989 +10
+ Misses 1997 1993 -4 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
tarcieri
force-pushed
the
fix-ct-issues
branch
from
October 23, 2026 02:12
96d77c7 to
1443959
Compare
tarcieri
added a commit
to RustCrypto/utils
that referenced
this pull request
Oct 23, 2026
Adds a set of functions extracted from RustCrypto/crypto-bigint#1360 which provide a set of reusable integer primitive operations where we were previously generating non-constant-time code on certain platforms. Validates the generated assembly is constant time using `cargo checkct`/BINSEC.
tarcieri
force-pushed
the
fix-ct-issues
branch
from
October 23, 2026 02:14
1443959 to
cea10c0
Compare
Member
Author
|
Note: this relies on a newly added If you think that's a bad idea and everything should just continue to live in I thought it would be interesting to try to push down everything that requires e.g. Thumb-1 or 32-bit specific workarounds into that, similar to how we force down various Edit: |
tarcieri
force-pushed
the
fix-ct-issues
branch
from
October 23, 2026 03:36
5446dcf to
d8958d7
Compare
tarcieri
changed the title
div_rem, nlimbs, and Montgomery muldiv_rem, nlimbs, and Montgomery mul
tarcieri
marked this pull request as ready for review
October 23, 2026 04:04
Merged
tarcieri
added a commit
that referenced
this pull request
Oct 23, 2026
## Added - Implement `Zeroize` for `EncodedUint` (#1342) ## Changed - Faster `floor_sqrt`, `checked_sqrt` implementation (#1312) - Bump `ctutils` to v0.4.4; MSRV 1.87 (#1350, #1359) ## Fixed - `BoxedUint` GCD with mixed-precision zero operands (#1291) - Carry result from Karatsuba `wrapping_square` for larger integers (#1309) - Exact division edge cases (#1310) - Only use classic binary GCD in Jacobi symbol calculation (#1313) - Montgomery reduction in repeated squaring (#1344) - safegcd iteration count overflow at precisions of 93558 bits and above (#1346) - Carry returned by `Uint::try_sub_with_carry` (#1354) ## Security - Make `UintRef::PartialEq` constant-time (#1311) - Avoid branching on invertibility in `BoxedMontyForm::invert` (#1355) - `borrowing_sub` constant-timeness; use `cargo checkct` (#1358) - CT leaks in CTZ, `div_rem`, `nlimbs`, and Montgomery mul (#1360)
tarcieri
added a commit
to RustCrypto/RSA
that referenced
this pull request
Oct 23, 2026
Adds some initial testing of operations intended to be constant-time using `cargo checkct`, a wrapper for BINSEC that is able to static analysis looking for constant-time issues. Namely this checks that `i2osp_zeroizing` avoids secret-dependent control flow and memory accesses for small fixed-width encoding, padding, and truncation cases. We currently check RISCV32, Thumb-2, and x86-64, since these are what are supported by `cargo checkct`. Unlike other places we've deployed this, we can't test Thumb-1 due to use of `Arc`. These tests have been configured to run in CI to detect regressions. See also: - RustCrypto/crypto-bigint#1358 - RustCrypto/crypto-bigint#1360
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix secret-dependent branches in zero counting, bit-length rounding, division, and Montgomery multiplication. Reuse the hardened primitives and
Choiceoperations from RustCrypto/utils#1570 and RustCrypto/utils#1571.Add
cargo checkctregressions across Thumb-1, Thumb-2, RISCV32, and x86-64, including unoptimized coverage fornlimbs.