From 3c085d264c762447571466fdec634d3ed51a2b5f Mon Sep 17 00:00:00 2001
From: Henry de Valence <hdevalence@chain.com>
Date: Mon, 30 Oct 2017 14:34:36 -0700
Subject: [PATCH] Change Scalar32 and Scalar64 to not mask the high 3 bits of a
 Scalar.

This should not cause overflow, since this just lets the high limb have the
same bounds as the other limbs, but we should check this carefully.
---
 src/scalar_32bit.rs | 8 ++------
 src/scalar_64bit.rs | 8 ++------
 2 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/src/scalar_32bit.rs b/src/scalar_32bit.rs
index b0d8b57..9196e52 100644
--- a/src/scalar_32bit.rs
+++ b/src/scalar_32bit.rs
@@ -9,9 +9,6 @@
 //! depend on how the limbs are combined, but will stay within
 //! -0x1ffffffe00000008 (62 bits with sign bit) to
 //! 0x43fffffbc0000011 (63 bits), which is still safe.
-//!
-//! (the 9th limb will never exceed 21 bits, so the actual
-//! ranges are slightly smaller)
 
 use core::fmt::Debug;
 use core::ops::{Index, IndexMut};
@@ -53,7 +50,7 @@ impl Scalar32 {
         Scalar32([0,0,0,0,0,0,0,0,0])
     }
 
-    /// Unpack a 32 byte / 512 bit scalar into 9 29-bit limbs, ignoring the upper 3 bits.
+    /// Unpack a 32 byte / 256 bit scalar into 9 29-bit limbs.
     pub fn from_bytes(bytes: &[u8; 32]) -> Scalar32 {
         let mut words = [0u32; 8];
         for i in 0..8 {
@@ -63,7 +60,7 @@ impl Scalar32 {
         }
 
         let mask = (1u32 << 29) - 1;
-        let top_mask = (1u32 << 21) - 1;
+        let top_mask = (1u32 << 24) - 1;
         let mut s = Scalar32::zero();
 
         s[ 0] =   words[0]                            & mask;
@@ -377,7 +374,6 @@ impl Scalar32 {
     }
 }
 
-
 #[cfg(test)]
 mod test {
     use super::*;
diff --git a/src/scalar_64bit.rs b/src/scalar_64bit.rs
index 7076b56..4440a0b 100644
--- a/src/scalar_64bit.rs
+++ b/src/scalar_64bit.rs
@@ -7,10 +7,6 @@
 //! To see that this is safe for intermediate results, note that
 //! the largest limb in a 5 by 5 product of 52-bit limbs will be
 //! (0xfffffffffffff^2) * 5 = 0x4ffffffffffff60000000000005 (107 bits).
-//!
-//! (the 5th limb will never exceed 45 bits, so the actual
-//! ranges are slightly smaller)
-
 
 use core::fmt::Debug;
 use core::ops::{Index, IndexMut};
@@ -52,7 +48,7 @@ impl Scalar64 {
         Scalar64([0,0,0,0,0])
     }
 
-    /// Unpack a 32 byte / 256 bit scalar into 5 52-bit limbs, ignoring the upper 3 bits
+    /// Unpack a 32 byte / 256 bit scalar into 5 52-bit limbs.
     pub fn from_bytes(bytes: &[u8; 32]) -> Scalar64 {
         let mut words = [0u64; 8];
         for i in 0..4 {
@@ -62,7 +58,7 @@ impl Scalar64 {
         }
 
         let mask = (1u64 << 52) - 1;
-        let top_mask = (1u64 << 45) - 1;
+        let top_mask = (1u64 << 48) - 1;
         let mut s = Scalar64::zero();
 
         s[ 0] =   words[0]                            & mask;