Start verifying that code which should be constant-time really is.

[catacomb] / pub / ed448.c

diff --git a/pub/ed448.c b/pub/ed448.c
index 714987f..ae56556 100644 (file)
--- a/pub/ed448.c
+++ b/pub/ed448.c
@@ -424,6 +424,8 @@ int ed448_verify(const octet K[ED448_PUBSZ],
 #include <mLib/report.h>
 #include <mLib/testrig.h>
 
+#include "ct.h"
+
 static int vrf_pubkey(dstr dv[])
 {
   dstr dpub = DSTR_INIT;
@@ -431,8 +433,10 @@ static int vrf_pubkey(dstr dv[])
 
   if (dv[1].len != ED448_PUBSZ) die(1, "bad pub length");
 
+  ct_poison(dv[0].buf, dv[0].len);
   dstr_ensure(&dpub, ED448_PUBSZ); dpub.len = ED448_PUBSZ;
   ed448_pubkey((octet *)dpub.buf, dv[0].buf, dv[0].len);
+  ct_remedy(dpub.buf, dpub.len);
   if (memcmp(dpub.buf, dv[1].buf, ED448_PUBSZ) != 0) {
     ok = 0;
     fprintf(stderr, "failed!");
@@ -456,6 +460,7 @@ static int vrf_sign(dstr *priv, int phflag, dstr *perso,
 
   if (want->len != ED448_SIGSZ) die(1, "bad result length");
 
+  ct_poison(priv->buf, priv->len);
   dstr_ensure(&dsig, ED448_SIGSZ); dsig.len = ED448_SIGSZ;
   if (phflag <= 0)
     m = msg;
@@ -470,6 +475,7 @@ static int vrf_sign(dstr *priv, int phflag, dstr *perso,
   ed448_sign((octet *)dsig.buf, priv->buf, priv->len, K,
             phflag, perso ? perso->buf : 0, perso ? perso->len : 0,
             m->buf, m->len);
+  ct_remedy(dsig.buf, dsig.len);
   if (memcmp(dsig.buf, want->buf, ED448_SIGSZ) != 0) {
     ok = 0;
     fprintf(stderr, "failed!");