saymrwulf/curve25519-dalek-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/curve25519-dalek-source.git synced 2026-09-05 20:30:57 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Check that s = |s| in decompression.

Browse source
This commit is contained in:
Henry de Valence 2017-02-20 16:58:01 -08:00
parent 9cb48c44ba
commit 93be83c6df
1 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/decaf.rs
View file

@ -54,9 +54,15 @@ impl CompressedDecaf {
/// Attempt to decompress to an `DecafPoint`.
pub fn decompress(&self) -> Option<DecafPoint> {
// XXX should decoding be CT ?
// XXX should reject unless s = |s|
// XXX need to check that xy is nonnegative and reject otherwise
let s = FieldElement::from_bytes(&self.0);
// Check that s = |s| and reject otherwise.
let mut abs_s = s;
let neg = abs_s.is_negative_decaf();
abs_s.conditional_negate(neg);
if abs_s != s { return None; }
let ss = s.square();
let X = &s + &s; // X = 2s
let Z = &FieldElement::one() - &ss; // Z = 1+as^2
@ -275,6 +281,14 @@ mod test {
use curve::Identity;
use super::*;
#[test]
#[should_panic]
fn test_decaf_decompress_negative_s_fails() {
// constants::d is neg, so decompression should fail as |d| != d.
let bad_compressed = CompressedDecaf(constants::d.to_bytes());
bad_compressed.decompress().unwrap();
}
#[test]
fn test_decaf_decompress_id() {
let compressed_id = CompressedDecaf::identity();