mirror of
https://github.com/serai-dex/serai.git
synced 2025-12-14 23:19:24 +00:00
Constant-time divisors (#617)
* WIP constant-time implementation of the ec-divisors library * Fix misc logic errors in poly.rs * Remove accidentally committed test statements * Fix ConstantTimeEq for CoefficientIndex * Correct the iterations formula x**3 / (0 y + x**1) would prior be considered indivisible with iterations = 0. It is divisible however. The amount of iterations should be the amount of coefficients within the numerator *excluding the coefficient for y**0 x**0*. * Poly PartialEq, conditional_select_poly which checks poly structure equivalence If the first passed argument is smaller than the latter, it's padded to the necessary length. Also adds code to trim the remainder as the remainder is the value modulo, so it's very important it remains concise and workable. * Fix the line function It selected the case if both were identity before selecting the case if either were identity, the latter overwriting the former. * Final fixes re: ct_get 1) Our quotient structure does need to be of size equal to the numerator entirely to prevent out-of-bounds reads on it 2) We need to get from yx_coefficients if of length >=, so if the length is 1 we can read y_pow=1 from it. If y_pow=0, and its length is 0 so it has no inner Vecs, we need to fall back with the guard y_pow != 0. * Add a trim algorithm to lib.rs to prevent Polys from becoming unbearably gigantic Our Poly algorithm is incredibly leaky. While it presumably should be improved, we can take advantage of our known structure while constructing divisors (and the small modulus) to simply trim out the zero coefficients leaked. This maintains Polys in a manageable size. * Move constant-time scalar mul gadget divisor creation from dkg to ec-divisors Anyone creating a divisor for the scalar mul gadget should use constant time code, so this code should at least be in the EC gadgets crate It's of non-trivial complexity to deal with otherwise. * Remove unsafe, cache timing attacks from ec-divisors
This commit is contained in:
Luke Parker
GitHub
@@ -3,21 +3,24 @@
|
||||
#![deny(missing_docs)]
|
||||
#![allow(non_snake_case)]
|
||||
|
||||
use subtle::{Choice, ConstantTimeEq, ConstantTimeGreater, ConditionallySelectable};
|
||||
use zeroize::{Zeroize, ZeroizeOnDrop};
|
||||
|
||||
use group::{
|
||||
ff::{Field, PrimeField},
|
||||
ff::{Field, PrimeField, PrimeFieldBits},
|
||||
Group,
|
||||
};
|
||||
|
||||
mod poly;
|
||||
pub use poly::*;
|
||||
pub use poly::Poly;
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests;
|
||||
|
||||
/// A curve usable with this library.
|
||||
pub trait DivisorCurve: Group {
|
||||
pub trait DivisorCurve: Group + ConstantTimeEq + ConditionallySelectable {
|
||||
/// An element of the field this curve is defined over.
|
||||
type FieldElement: PrimeField;
|
||||
type FieldElement: Zeroize + PrimeField + ConditionallySelectable;
|
||||
|
||||
/// The A in the curve equation y^2 = x^3 + A x + B.
|
||||
fn a() -> Self::FieldElement;
|
||||
@@ -72,46 +75,89 @@ pub(crate) fn slope_intercept<C: DivisorCurve>(a: C, b: C) -> (C::FieldElement,
|
||||
}
|
||||
|
||||
// The line interpolating two points.
|
||||
fn line<C: DivisorCurve>(a: C, mut b: C) -> Poly<C::FieldElement> {
|
||||
// If they're both the point at infinity, we simply set the line to one
|
||||
if bool::from(a.is_identity() & b.is_identity()) {
|
||||
return Poly {
|
||||
y_coefficients: vec![],
|
||||
yx_coefficients: vec![],
|
||||
x_coefficients: vec![],
|
||||
zero_coefficient: C::FieldElement::ONE,
|
||||
};
|
||||
fn line<C: DivisorCurve>(a: C, b: C) -> Poly<C::FieldElement> {
|
||||
#[derive(Clone, Copy)]
|
||||
struct LinesRes<F: ConditionallySelectable> {
|
||||
y_coefficient: F,
|
||||
x_coefficient: F,
|
||||
zero_coefficient: F,
|
||||
}
|
||||
impl<F: ConditionallySelectable> ConditionallySelectable for LinesRes<F> {
|
||||
fn conditional_select(a: &Self, b: &Self, choice: Choice) -> Self {
|
||||
Self {
|
||||
y_coefficient: <_>::conditional_select(&a.y_coefficient, &b.y_coefficient, choice),
|
||||
x_coefficient: <_>::conditional_select(&a.x_coefficient, &b.x_coefficient, choice),
|
||||
zero_coefficient: <_>::conditional_select(&a.zero_coefficient, &b.zero_coefficient, choice),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
let a_is_identity = a.is_identity();
|
||||
let b_is_identity = b.is_identity();
|
||||
|
||||
// If they're both the point at infinity, we simply set the line to one
|
||||
let both_are_identity = a_is_identity & b_is_identity;
|
||||
let if_both_are_identity = LinesRes {
|
||||
y_coefficient: C::FieldElement::ZERO,
|
||||
x_coefficient: C::FieldElement::ZERO,
|
||||
zero_coefficient: C::FieldElement::ONE,
|
||||
};
|
||||
|
||||
// If either point is the point at infinity, or these are additive inverses, the line is
|
||||
// `1 * x - x`. The first `x` is a term in the polynomial, the `x` is the `x` coordinate of these
|
||||
// points (of which there is one, as the second point is either at infinity or has a matching `x`
|
||||
// coordinate).
|
||||
if bool::from(a.is_identity() | b.is_identity()) || (a == -b) {
|
||||
let (x, _) = C::to_xy(if !bool::from(a.is_identity()) { a } else { b }).unwrap();
|
||||
return Poly {
|
||||
y_coefficients: vec![],
|
||||
yx_coefficients: vec![],
|
||||
x_coefficients: vec![C::FieldElement::ONE],
|
||||
let one_is_identity = a_is_identity | b_is_identity;
|
||||
let additive_inverses = a.ct_eq(&-b);
|
||||
let one_is_identity_or_additive_inverses = one_is_identity | additive_inverses;
|
||||
let if_one_is_identity_or_additive_inverses = {
|
||||
// If both are identity, set `a` to the generator so we can safely evaluate the following
|
||||
// (which we won't select at the end of this function)
|
||||
let a = <_>::conditional_select(&a, &C::generator(), both_are_identity);
|
||||
// If `a` is identity, this selects `b`. If `a` isn't identity, this selects `a`
|
||||
let non_identity = <_>::conditional_select(&a, &b, a.is_identity());
|
||||
let (x, _) = C::to_xy(non_identity).unwrap();
|
||||
LinesRes {
|
||||
y_coefficient: C::FieldElement::ZERO,
|
||||
x_coefficient: C::FieldElement::ONE,
|
||||
zero_coefficient: -x,
|
||||
};
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
// The following calculation assumes neither point is the point at infinity
|
||||
// If either are, we use a prior result
|
||||
// To ensure we can calculcate a result here, set any points at infinity to the generator
|
||||
let a = <_>::conditional_select(&a, &C::generator(), a_is_identity);
|
||||
let b = <_>::conditional_select(&b, &C::generator(), b_is_identity);
|
||||
// It also assumes a, b aren't additive inverses which is also covered by a prior result
|
||||
let b = <_>::conditional_select(&b, &a.double(), additive_inverses);
|
||||
|
||||
// If the points are equal, we use the line interpolating the sum of these points with the point
|
||||
// at infinity
|
||||
if a == b {
|
||||
b = -a.double();
|
||||
}
|
||||
let b = <_>::conditional_select(&b, &-a.double(), a.ct_eq(&b));
|
||||
|
||||
let (slope, intercept) = slope_intercept::<C>(a, b);
|
||||
|
||||
// Section 4 of the proofs explicitly state the line `L = y - lambda * x - mu`
|
||||
// y - (slope * x) - intercept
|
||||
Poly {
|
||||
y_coefficients: vec![C::FieldElement::ONE],
|
||||
yx_coefficients: vec![],
|
||||
x_coefficients: vec![-slope],
|
||||
let mut res = LinesRes {
|
||||
y_coefficient: C::FieldElement::ONE,
|
||||
x_coefficient: -slope,
|
||||
zero_coefficient: -intercept,
|
||||
};
|
||||
|
||||
res = <_>::conditional_select(
|
||||
&res,
|
||||
&if_one_is_identity_or_additive_inverses,
|
||||
one_is_identity_or_additive_inverses,
|
||||
);
|
||||
res = <_>::conditional_select(&res, &if_both_are_identity, both_are_identity);
|
||||
|
||||
Poly {
|
||||
y_coefficients: vec![res.y_coefficient],
|
||||
yx_coefficients: vec![],
|
||||
x_coefficients: vec![res.x_coefficient],
|
||||
zero_coefficient: res.zero_coefficient,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -121,36 +167,65 @@ fn line<C: DivisorCurve>(a: C, mut b: C) -> Poly<C::FieldElement> {
|
||||
/// - No points were passed in
|
||||
/// - The points don't sum to the point at infinity
|
||||
/// - A passed in point was the point at infinity
|
||||
///
|
||||
/// If the arguments were valid, this function executes in an amount of time constant to the amount
|
||||
/// of points.
|
||||
#[allow(clippy::new_ret_no_self)]
|
||||
pub fn new_divisor<C: DivisorCurve>(points: &[C]) -> Option<Poly<C::FieldElement>> {
|
||||
// A single point is either the point at infinity, or this doesn't sum to the point at infinity
|
||||
// Both cause us to return None
|
||||
if points.len() < 2 {
|
||||
None?;
|
||||
}
|
||||
if points.iter().sum::<C>() != C::identity() {
|
||||
// No points were passed in, this is the point at infinity, or the single point isn't infinity
|
||||
// and accordingly doesn't sum to infinity. All three cause us to return None
|
||||
// Checks a bit other than the first bit is set, meaning this is >= 2
|
||||
let mut invalid_args = (points.len() & (!1)).ct_eq(&0);
|
||||
// The points don't sum to the point at infinity
|
||||
invalid_args |= !points.iter().sum::<C>().is_identity();
|
||||
// A point was the point at identity
|
||||
for point in points {
|
||||
invalid_args |= point.is_identity();
|
||||
}
|
||||
if bool::from(invalid_args) {
|
||||
None?;
|
||||
}
|
||||
|
||||
let points_len = points.len();
|
||||
|
||||
// Create the initial set of divisors
|
||||
let mut divs = vec![];
|
||||
let mut iter = points.iter().copied();
|
||||
while let Some(a) = iter.next() {
|
||||
if a == C::identity() {
|
||||
None?;
|
||||
}
|
||||
|
||||
let b = iter.next();
|
||||
if b == Some(C::identity()) {
|
||||
None?;
|
||||
}
|
||||
|
||||
// Draw the line between those points
|
||||
divs.push((a + b.unwrap_or(C::identity()), line::<C>(a, b.unwrap_or(-a))));
|
||||
// These unwraps are branching on the length of the iterator, not violating the constant-time
|
||||
// priorites desired
|
||||
divs.push((2, a + b.unwrap_or(C::identity()), line::<C>(a, b.unwrap_or(-a))));
|
||||
}
|
||||
|
||||
let modulus = C::divisor_modulus();
|
||||
|
||||
// Our Poly algorithm is leaky and will create an excessive amount of y x**j and x**j
|
||||
// coefficients which are zero, yet as our implementation is constant time, still come with
|
||||
// an immense performance cost. This code truncates the coefficients we know are zero.
|
||||
let trim = |divisor: &mut Poly<_>, points_len: usize| {
|
||||
// We should only be trimming divisors reduced by the modulus
|
||||
debug_assert!(divisor.yx_coefficients.len() <= 1);
|
||||
if divisor.yx_coefficients.len() == 1 {
|
||||
let truncate_to = ((points_len + 1) / 2).saturating_sub(2);
|
||||
#[cfg(debug_assertions)]
|
||||
for p in truncate_to .. divisor.yx_coefficients[0].len() {
|
||||
debug_assert_eq!(divisor.yx_coefficients[0][p], <C::FieldElement as Field>::ZERO);
|
||||
}
|
||||
divisor.yx_coefficients[0].truncate(truncate_to);
|
||||
}
|
||||
{
|
||||
let truncate_to = points_len / 2;
|
||||
#[cfg(debug_assertions)]
|
||||
for p in truncate_to .. divisor.x_coefficients.len() {
|
||||
debug_assert_eq!(divisor.x_coefficients[p], <C::FieldElement as Field>::ZERO);
|
||||
}
|
||||
divisor.x_coefficients.truncate(truncate_to);
|
||||
}
|
||||
};
|
||||
|
||||
// Pair them off until only one remains
|
||||
while divs.len() > 1 {
|
||||
let mut next_divs = vec![];
|
||||
@@ -159,23 +234,208 @@ pub fn new_divisor<C: DivisorCurve>(points: &[C]) -> Option<Poly<C::FieldElement
|
||||
next_divs.push(divs.pop().unwrap());
|
||||
}
|
||||
|
||||
while let Some((a, a_div)) = divs.pop() {
|
||||
let (b, b_div) = divs.pop().unwrap();
|
||||
while let Some((a_points, a, a_div)) = divs.pop() {
|
||||
let (b_points, b, b_div) = divs.pop().unwrap();
|
||||
let points = a_points + b_points;
|
||||
|
||||
// Merge the two divisors
|
||||
let numerator = a_div.mul_mod(b_div, &modulus).mul_mod(line::<C>(a, b), &modulus);
|
||||
let denominator = line::<C>(a, -a).mul_mod(line::<C>(b, -b), &modulus);
|
||||
let (q, r) = numerator.div_rem(&denominator);
|
||||
assert_eq!(r, Poly::zero());
|
||||
let numerator = a_div.mul_mod(&b_div, &modulus).mul_mod(&line::<C>(a, b), &modulus);
|
||||
let denominator = line::<C>(a, -a).mul_mod(&line::<C>(b, -b), &modulus);
|
||||
let (mut q, r) = numerator.div_rem(&denominator);
|
||||
debug_assert_eq!(r, Poly::zero());
|
||||
|
||||
next_divs.push((a + b, q));
|
||||
trim(&mut q, 1 + points);
|
||||
|
||||
next_divs.push((points, a + b, q));
|
||||
}
|
||||
|
||||
divs = next_divs;
|
||||
}
|
||||
|
||||
// Return the unified divisor
|
||||
Some(divs.remove(0).1)
|
||||
let mut divisor = divs.remove(0).2;
|
||||
trim(&mut divisor, points_len);
|
||||
Some(divisor)
|
||||
}
|
||||
|
||||
/// The decomposition of a scalar.
|
||||
///
|
||||
/// The decomposition ($d$) of a scalar ($s$) has the following two properties:
|
||||
///
|
||||
/// - $\sum^{\mathsf{NUM_BITS} - 1}_{i=0} d_i * 2^i = s$
|
||||
/// - $\sum^{\mathsf{NUM_BITS} - 1}_{i=0} d_i = \mathsf{NUM_BITS}$
|
||||
#[derive(Clone, Zeroize, ZeroizeOnDrop)]
|
||||
pub struct ScalarDecomposition<F: Zeroize + PrimeFieldBits> {
|
||||
scalar: F,
|
||||
decomposition: Vec<u64>,
|
||||
}
|
||||
|
||||
impl<F: Zeroize + PrimeFieldBits> ScalarDecomposition<F> {
|
||||
/// Decompose a scalar.
|
||||
pub fn new(scalar: F) -> Self {
|
||||
/*
|
||||
We need the sum of the coefficients to equal F::NUM_BITS. The scalar's bits will be less than
|
||||
F::NUM_BITS. Accordingly, we need to increment the sum of the coefficients without
|
||||
incrementing the scalar represented. We do this by finding the highest non-0 coefficient,
|
||||
decrementing it, and increasing the immediately less significant coefficient by 2. This
|
||||
increases the sum of the coefficients by 1 (-1+2=1).
|
||||
*/
|
||||
|
||||
let num_bits = u64::from(F::NUM_BITS);
|
||||
|
||||
// Obtain the bits of the scalar
|
||||
let num_bits_usize = usize::try_from(num_bits).unwrap();
|
||||
let mut decomposition = vec![0; num_bits_usize];
|
||||
for (i, bit) in scalar.to_le_bits().into_iter().take(num_bits_usize).enumerate() {
|
||||
let bit = u64::from(u8::from(bit));
|
||||
decomposition[i] = bit;
|
||||
}
|
||||
|
||||
// The following algorithm only works if the value of the scalar exceeds num_bits
|
||||
// If it isn't, we increase it by the modulus such that it does exceed num_bits
|
||||
{
|
||||
let mut less_than_num_bits = Choice::from(0);
|
||||
for i in 0 .. num_bits {
|
||||
less_than_num_bits |= scalar.ct_eq(&F::from(i));
|
||||
}
|
||||
let mut decomposition_of_modulus = vec![0; num_bits_usize];
|
||||
// Decompose negative one
|
||||
for (i, bit) in (-F::ONE).to_le_bits().into_iter().take(num_bits_usize).enumerate() {
|
||||
let bit = u64::from(u8::from(bit));
|
||||
decomposition_of_modulus[i] = bit;
|
||||
}
|
||||
// Increment it by one
|
||||
decomposition_of_modulus[0] += 1;
|
||||
|
||||
// Add the decomposition onto the decomposition of the modulus
|
||||
for i in 0 .. num_bits_usize {
|
||||
let new_decomposition = <_>::conditional_select(
|
||||
&decomposition[i],
|
||||
&(decomposition[i] + decomposition_of_modulus[i]),
|
||||
less_than_num_bits,
|
||||
);
|
||||
decomposition[i] = new_decomposition;
|
||||
}
|
||||
}
|
||||
|
||||
// Calculcate the sum of the coefficients
|
||||
let mut sum_of_coefficients: u64 = 0;
|
||||
for decomposition in &decomposition {
|
||||
sum_of_coefficients += *decomposition;
|
||||
}
|
||||
|
||||
/*
|
||||
Now, because we added a log2(k)-bit number to a k-bit number, we may have our sum of
|
||||
coefficients be *too high*. We attempt to reduce the sum of the coefficients accordingly.
|
||||
|
||||
This algorithm is guaranteed to complete as expected. Take the sequence `222`. `222` becomes
|
||||
`032` becomes `013`. Even if the next coefficient in the sequence is `2`, the third
|
||||
coefficient will be reduced once and the next coefficient (`2`, increased to `3`) will only
|
||||
be eligible for reduction once. This demonstrates, even for a worst case of log2(k) `2`s
|
||||
followed by `1`s (as possible if the modulus is a Mersenne prime), the log2(k) `2`s can be
|
||||
reduced as necessary so long as there is a single coefficient after (requiring the entire
|
||||
sequence be at least of length log2(k) + 1). For a 2-bit number, log2(k) + 1 == 2, so this
|
||||
holds for any odd prime field.
|
||||
|
||||
To fully type out the demonstration for the Mersenne prime 3, with scalar to encode 1 (the
|
||||
highest value less than the number of bits):
|
||||
|
||||
10 - Little-endian bits of 1
|
||||
21 - Little-endian bits of 1, plus the modulus
|
||||
02 - After one reduction, where the sum of the coefficients does in fact equal 2 (the target)
|
||||
*/
|
||||
{
|
||||
let mut log2_num_bits = 0;
|
||||
while (1 << log2_num_bits) < num_bits {
|
||||
log2_num_bits += 1;
|
||||
}
|
||||
|
||||
for _ in 0 .. log2_num_bits {
|
||||
// If the sum of coefficients is the amount of bits, we're done
|
||||
let mut done = sum_of_coefficients.ct_eq(&num_bits);
|
||||
|
||||
for i in 0 .. (num_bits_usize - 1) {
|
||||
let should_act = (!done) & decomposition[i].ct_gt(&1);
|
||||
// Subtract 2 from this coefficient
|
||||
let amount_to_sub = <_>::conditional_select(&0, &2, should_act);
|
||||
decomposition[i] -= amount_to_sub;
|
||||
// Add 1 to the next coefficient
|
||||
let amount_to_add = <_>::conditional_select(&0, &1, should_act);
|
||||
decomposition[i + 1] += amount_to_add;
|
||||
|
||||
// Also update the sum of coefficients
|
||||
sum_of_coefficients -= <_>::conditional_select(&0, &1, should_act);
|
||||
|
||||
// If we updated the coefficients this loop iter, we're done for this loop iter
|
||||
done |= should_act;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for _ in 0 .. num_bits {
|
||||
// If the sum of coefficients is the amount of bits, we're done
|
||||
let mut done = sum_of_coefficients.ct_eq(&num_bits);
|
||||
|
||||
// Find the highest coefficient currently non-zero
|
||||
for i in (1 .. decomposition.len()).rev() {
|
||||
// If this is non-zero, we should decrement this coefficient if we haven't already
|
||||
// decremented a coefficient this round
|
||||
let is_non_zero = !(0.ct_eq(&decomposition[i]));
|
||||
let should_act = (!done) & is_non_zero;
|
||||
|
||||
// Update this coefficient and the prior coefficient
|
||||
let amount_to_sub = <_>::conditional_select(&0, &1, should_act);
|
||||
decomposition[i] -= amount_to_sub;
|
||||
|
||||
let amount_to_add = <_>::conditional_select(&0, &2, should_act);
|
||||
// i must be at least 1, so i - 1 will be at least 0 (meaning it's safe to index with)
|
||||
decomposition[i - 1] += amount_to_add;
|
||||
|
||||
// Also update the sum of coefficients
|
||||
sum_of_coefficients += <_>::conditional_select(&0, &1, should_act);
|
||||
|
||||
// If we updated the coefficients this loop iter, we're done for this loop iter
|
||||
done |= should_act;
|
||||
}
|
||||
}
|
||||
debug_assert!(bool::from(decomposition.iter().sum::<u64>().ct_eq(&num_bits)));
|
||||
|
||||
ScalarDecomposition { scalar, decomposition }
|
||||
}
|
||||
|
||||
/// The decomposition of the scalar.
|
||||
pub fn decomposition(&self) -> &[u64] {
|
||||
&self.decomposition
|
||||
}
|
||||
|
||||
/// A divisor to prove a scalar multiplication.
|
||||
///
|
||||
/// The divisor will interpolate $d_i$ instances of $2^i \cdot G$ with $-(s \cdot G)$.
|
||||
///
|
||||
/// This function executes in constant time with regards to the scalar.
|
||||
///
|
||||
/// This function MAY panic if this scalar is zero.
|
||||
pub fn scalar_mul_divisor<C: Zeroize + DivisorCurve<Scalar = F>>(
|
||||
&self,
|
||||
mut generator: C,
|
||||
) -> Poly<C::FieldElement> {
|
||||
// The following for loop is constant time to the sum of `dlog`'s elements
|
||||
let mut divisor_points =
|
||||
Vec::with_capacity(usize::try_from(<C::Scalar as PrimeField>::NUM_BITS).unwrap());
|
||||
divisor_points.push(-generator * self.scalar);
|
||||
for coefficient in &self.decomposition {
|
||||
let mut coefficient = *coefficient;
|
||||
while coefficient != 0 {
|
||||
coefficient -= 1;
|
||||
divisor_points.push(generator);
|
||||
}
|
||||
generator = generator.double();
|
||||
}
|
||||
|
||||
let res = new_divisor(&divisor_points).unwrap();
|
||||
divisor_points.zeroize();
|
||||
res
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(any(test, feature = "pasta"))]
|
||||
|
||||
Reference in New Issue
Block a user