From e6d6321ab5a579b0956e67585d909d560364107d Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Wed, 27 Aug 2025 20:27:02 +0200 Subject: [PATCH] More optblockers. - ristretto255_is_canonical - fe25519_reduce64 - ge25519_from_uniform --- src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c index a5b51a3d..6ae5dc4f 100644 --- a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c +++ b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c @@ -397,7 +397,7 @@ ge25519_frombytes_negate_vartime(ge25519_p3 *h, const unsigned char *s) fe25519_mul(h->X, h->X, fe25519_sqrtm1); } - if (fe25519_isnegative(h->X) == (s[31] >> 7)) { + if (fe25519_isnegative(h->X) == (s[31] >> 7)) { /* vartime function - compiler optimization is fine */ fe25519_neg(h->X, h->X); } fe25519_mul(h->T, h->X, h->Y); @@ -2698,7 +2698,7 @@ ge25519_from_uniform(unsigned char s[32], const unsigned char r[32]) unsigned char x_sign; memcpy(s, r, 32); - x_sign = s[31] >> 7; + x_sign = ((s[31] >> 5) ^ optblocker_u8) >> 2; s[31] &= 0x7f; fe25519_frombytes(r_fe, s); @@ -2728,7 +2728,8 @@ fe25519_reduce64(fe25519 fe_f, const unsigned char h[64]) gl[31] &= 0x7f; fe25519_frombytes(fe_f, fl); fe25519_frombytes(fe_g, gl); - fe_f[0] += (h[31] >> 7) * 19 + (h[63] >> 7) * 722; + fe_f[0] += (((h[31] >> 5) ^ optblocker_u8) >> 2) * 19 + + (((h[63] >> 5) ^ optblocker_u8) >> 2) * 722; for (i = 0; i < sizeof (fe25519) / sizeof fe_f[0]; i++) { fe_f[i] += 38 * fe_g[i]; } @@ -2811,7 +2812,7 @@ ristretto255_is_canonical(const unsigned char *s) } c = (((unsigned int) c) - 1U) >> 8; d = (0xed - 1U - (unsigned int) s[0]) >> 8; - e = s[31] >> 7; + e = ((s[31] >> 5) ^ optblocker_u8) >> 2; return 1 - (((c & d) | e | s[0]) & 1); }