Re: [PATCH] ecc: make l_ecc_point_from_data const time (for compressed points)

[Denis Kenzior <denkenz at gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1088 bytes --]

Hi James,

On 1/12/22 16:40, James Prestwood wrote:
> This only alters the two compressed point types as there isn't a security
> reason to make the function const time for compliant/full point data as
> these are never used in conjunction with compressed points.
> 
> The timing difference came down mainly to the conditional _vli_mod_sub call
> which was only called depending on the first bit of p->y. More subtly the
> check differered between BIT0 and BIT1 by a '!' operation which would result
> in an additional instruction.
> 
> This patch addresses the '!' operation by checking if the subtraction is
> needed and considering both compressed types in that logic.
> 
> For the subtraction, it is now done unconditionally and the result is stored
> in a temporary variable. Then l_secure_select is used to copy the data to
> p->y, or back into the temporary variable depending on if 'need_sub' evaluated
> to true.
> ---
>   ell/ecc.c | 20 ++++++++++----------
>   1 file changed, 10 insertions(+), 10 deletions(-)
> 

Applied, thanks.

Regards,
-Denis