]> Cypherpunks repositories - gostls13.git/commit
crypto/(ec)dsa: use Fermat's inversion.
authorAdam Langley <agl@golang.org>
Tue, 8 Apr 2014 23:32:48 +0000 (16:32 -0700)
committerAdam Langley <agl@golang.org>
Tue, 8 Apr 2014 23:32:48 +0000 (16:32 -0700)
commitf23d3ea85afce3c4940bcf55889625d2e2017128
tree5b37616565b2e4609a3d9280a847aa597f459366
parentc5f14c55c19d872921b476187f153a7361a80fa7
crypto/(ec)dsa: use Fermat's inversion.

Now that we have a constant-time P-256 implementation, it's worth
paying more attention elsewhere.

The inversion of k in (EC)DSA was using Euclid's algorithm which isn't
constant-time. This change switches to Fermat's algorithm, which is
much better. However, it's important to note that math/big itself isn't
constant time and is using a 4-bit window for exponentiation with
variable memory access patterns.

(Since math/big depends quite deeply on its values being in minimal (as
opposed to fixed-length) represetation, perhaps crypto/elliptic should
grow a constant-time implementation of exponentiation in the scalar
field.)

R=bradfitz
Fixes #7652.

LGTM=rsc
R=golang-codereviews, bradfitz, rsc
CC=golang-codereviews
https://golang.org/cl/82740043
src/pkg/crypto/dsa/dsa.go
src/pkg/crypto/ecdsa/ecdsa.go