| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
the encode(2) routines are constant time now, so
use them instead of using lookup table that can
leak information through cache timing side channel.
|
|
mischief found this in rsafill()'s call mpmod(c2, x, x), where
d parameter is negative (rsagen created a rsa key with negative dk).
|
|
|
|
|
|
|
|
|
|
mpinvert()
|
|
the prior implementation was unneccesarily complicated for
no good reason due to me misunderstanding how libc's nrand()
works. in contrast to libc, we already generate the *closest*
power-of-2 random number with mprand() in the sampling loop.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
in progress)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
instead of testing for special field primes each time in mpmod(),
make it explicit with a mpfiled() function that tests a modulus N
to be of some special form that can be reduced more efficiently with
some precalculation, and replaces N with a Mfield* when it can. the
Mfield*'s are recognized by mpmod() as they have the MPfield flag
set and provide a function pointer that executes the fast reduction.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
primes (for ecc)
introduce MPtimesafe flag to request time invariant computation
disables normalization so significant digits are not leaked.
|
|
|
