)]}'
{
  "commit": "0e22042f444eb9a672201fe6183e09ed040d734b",
  "tree": "38f808979fb0ff867e076c5c390ef95465c333de",
  "parents": [
    "6814079bb95125a8e9b5849bfd31611977a9c523"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Wed Apr 22 18:29:02 2026 -0400"
  },
  "committer": {
    "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Thu Apr 23 09:59:42 2026 -0700"
  },
  "message": "Fix beeu_mod_inverse_vartime on aarch64\n\nhttps://boringssl-review.googlesource.com/c/boringssl/+/51805 added an\naarch64 version of the x86_64 beeu_mod_inverse_vartime. However, it did\nnot quite get the shift operations right for A and B.\n\nIf clz happened to return 64, the SHIFT256 macro bumps into aarch64 only\nlooking at the bottom 6 bits of the shift operand. That means, instead\nof shifting the value, it jumbles the bits up a bit.\n\nFix this by clamping the shift amount to 63 bits at a time.\n\n(There is nothing significant about how much we clamp the shift. The\nfile was already trying to clamp the shift to 64 bits, though\nunsuccessfully. The x86_64 clamps it to 27 bits, because it needs to\ncompute the shift amount very differently. Though this does mean that\nthe Python pseudocode isn\u0027t right because it omits clmaping.)\n\nThis function is only used in P-256 ECDSA verification (not signing), on\naarch64 non-small builds. Because it still outputs *some* scalar, we do\nnot believe it (or really most mod inverse math bugs) can be\nmeaningfully used to forge ECDSA signatures:\n\nSuppose an attacker could find some (msg, r, s) tuple that triggered\nthis bug and caused ECDSA verification to pass. ECDSA verification only\nuses this function to compute inv(s) and afterwards never uses inv or s\nagain. The bug still outputs some valid scalar, so we have two cases:\n\nCase 1: buggy_inv(s) !\u003d 0\n\nSuppose the attacker instead passed (msg, r, correct_inv(buggy_inv(s))\nto a correct ECDSA verifier. The correct ECDSA verifier would then\ncompute s_inv \u003d buggy_inv(s) and then proceed the same as a verifier\nwith this bug. If that passes, that means the attacker must have been\nable to break ECDSA without this bug anyway.\n\nCase 2: buggy_inv(s) \u003d 0\n\nIf this bug causes ECDSA verification to proceed with s_inv \u003d 0, this\nwould bypass the s !\u003d 0 check at the start of verification. However, we\nwould then compute u1 \u003d u2 \u003d 0 and then 0 * pub + 0 * G \u003d infinity.\nExtracting the x-coordinate would then fail, so the signature would not\nbe accepted anyway.\n\nPut another way, ECDSA signatures should simply have been (r, s^-1), not\n(r, s). It\u0027s less work for the verifier, while both s and s^-1 are\nequally easy for a signer to compute.\n\nChange-Id: I91f44b57811f3eddd3f1973a7dc078c48e0329d7\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/93630\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e215969388aa3d5e58e91a51b72d6531f1f94b40",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/ec/asm/p256_beeu-armv8-asm.pl",
      "new_id": "38e146de211cee5c49f9a558f3f989e44ad7a74e",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/ec/asm/p256_beeu-armv8-asm.pl"
    },
    {
      "type": "modify",
      "old_id": "49534ca66c487050e42568e66232ad26b3960fdd",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/ec/p256-nistz_test.cc",
      "new_id": "4f24e96a49dc6781ae8f461ff3430cb991336979",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/ec/p256-nistz_test.cc"
    },
    {
      "type": "modify",
      "old_id": "1689310b3711c0ed5d87b7af5854f46156d7096d",
      "old_mode": 33188,
      "old_path": "gen/bcm/p256_beeu-armv8-asm-apple.S",
      "new_id": "af2f0efaae3af8063643086d43da8c6438100120",
      "new_mode": 33188,
      "new_path": "gen/bcm/p256_beeu-armv8-asm-apple.S"
    },
    {
      "type": "modify",
      "old_id": "7253ad4b45d1951601a5f0d5286a097ad122c72b",
      "old_mode": 33188,
      "old_path": "gen/bcm/p256_beeu-armv8-asm-linux.S",
      "new_id": "0c1cf05db0556e40d2424365b95134d9aaecd418",
      "new_mode": 33188,
      "new_path": "gen/bcm/p256_beeu-armv8-asm-linux.S"
    },
    {
      "type": "modify",
      "old_id": "534a81e234a3a005cfc6e49e497ee29b8287c9ec",
      "old_mode": 33188,
      "old_path": "gen/bcm/p256_beeu-armv8-asm-win.S",
      "new_id": "70440a17c73e55cc50059f2ed32eecdc082c5f08",
      "new_mode": 33188,
      "new_path": "gen/bcm/p256_beeu-armv8-asm-win.S"
    }
  ]
}