Non-constant time `cmov` in P256
Sc00bz opened this issue · 3 comments
You should use something like what curve25519_dalek uses:
https://doc.dalek.rs/subtle/trait.ConditionallySelectable.html#method.conditional_assign
https://github.com/novifinancial/opaque-ke/blob/d1dfee9a6545d7dfddc6dd94f985f31b3221c54e/src/group/p256.rs#L327-L333
Do you have any suggestion on how to fix this? Because ConditionallySelectable isn't implemented for BigInt.
Hmm well easiest conceptually is convert to arrays of 32 bytes, do bit select, and convert back. Oh wait I think because it's a bool it might compile to a branch. You might need to replace the bool stuff with an int of 0 or 1. Then you can use the int like selector = -b then do bit select ret_bytes[i] = x_bytes[i] ^ (selector & (x_bytes[i] ^ y_bytes[i])).
Side note I'm not sure how constant time big ints are. So even doing this might not be constant time, but it will be closer.
Would you mind making a PR?