)]}'
{
  "commit": "9b8b483276da2b3d36ea21e97743e310314a8de0",
  "tree": "f375612a9d5969c3f869afe446c25dd02d40115d",
  "parents": [
    "fce5cf02378a839174935b83b58f54aba6c2bb3e"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Tue Jan 16 15:48:17 2024 -0500"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Thu Mar 21 02:21:19 2024 +0000"
  },
  "message": "Start making asserts constant-time too\n\nWe\u0027ve historically settled on treating asserts as not in scope for our\nconstant-time goals. Production binaries are expected to be optimized\nbuilds, with debug assertions turned off. (We have a handful of\nassertions in perf-sensitive code that you definitely do not want to run\nwith.) Secret data has invariants too, so it is useful to be able to\nwrite debug assertions on them.\n\nHowever, combined with our default CMake build being a debug build, this\nseems to cause some confusion with researchers sometimes. Also, if we\never get language-level constant-time support, we would need to resolve\nthis mismatch anyway. (I assume any language support would put enough\ninto the type system to force us to declassify any intentional branches\non secret-by-data-flow bools, notably those we assert on.) So I\u0027m\ninclined to just make our asserts constant-time.\n\nThere are two issues around asserts, at least with our valgrind-based\nvalidation:\n\nThe first is that a couple of asserts over secret data compute their\ncondition leakily. We can just fix these. The only such ones I found\nwere in bn_reduce_once and bn_gcd_consttime.\n\nThe second is that almost every assert over secret data will be flagged\nas an invalid branch by valgrind. However, presuming the condition\nitself was computed in constant time, this branch is actually safe. If\nwe were willing to abort the process when false, the assert is clearly\npublicly true. We just need to declassify the boolean to assert on it.\n\nassert(constant_time_declassify_int(expr)) is really long, so I made an\ninternal wrapper macro declassify_assert(expr). Not sure if that\u0027s the\nbest name. constant_time_declassify_assert(expr) is kinda long.\nconstant_time_assert(expr) fits with the rest of that namespace, but\nreads as if we\u0027re somehow running an assert without branching, when the\nwhole point is that we *are* branching and need to explicitly say it\u0027s\nokay to.\n\nFixed: 339\nChange-Id: Ie33b99bf9a269b11d2c48d246cc4934be7e239ff\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/65467\nReviewed-by: Bob Beck \u003cbbe@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "fe902402be39c3e26a7e956b0b53794f24c2f008",
      "old_mode": 33188,
      "old_path": "CMakeLists.txt",
      "new_id": "59623e07d54b742f026c9c85ca192a0ea4874792",
      "new_mode": 33188,
      "new_path": "CMakeLists.txt"
    },
    {
      "type": "modify",
      "old_id": "ac6ca43f2fb161eb9e35fae867ac30f65427e6ed",
      "old_mode": 33188,
      "old_path": "crypto/cipher_extra/tls_cbc.c",
      "new_id": "ddbe4f2070d22fcc0571ec4316b5a2b80a9e5a8c",
      "new_mode": 33188,
      "new_path": "crypto/cipher_extra/tls_cbc.c"
    },
    {
      "type": "modify",
      "old_id": "581d74084e6abb797eaa9a5f3ecb5a5cd3747580",
      "old_mode": 33188,
      "old_path": "crypto/curve25519/curve25519.c",
      "new_id": "761af4cc8142abc8f1cccbb80d6fc37b1ff1923d",
      "new_mode": 33188,
      "new_path": "crypto/curve25519/curve25519.c"
    },
    {
      "type": "modify",
      "old_id": "d7f70dad6a1d9063e3264e67bf4cb1407f225657",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/bn/bytes.c",
      "new_id": "dcb0afc19aefcb8b67885d8d2b4228288f5008f4",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/bn/bytes.c"
    },
    {
      "type": "modify",
      "old_id": "6c13716920172aa08b09a7d7a728d968fccd5c6d",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/bn/div.c",
      "new_id": "f524f8939aecdcba534db9d807fe5efafeaca50b",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/bn/div.c"
    },
    {
      "type": "modify",
      "old_id": "141f7da67aaedfe49f396c3d9b707a4c8eea7288",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/bn/div_extra.c",
      "new_id": "f75c9146c2ecfb135efed3f1a37e787e6f351a65",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/bn/div_extra.c"
    },
    {
      "type": "modify",
      "old_id": "7b24d8950953d86c6e11d7238f7bd718238bcc7c",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/bn/exponentiation.c",
      "new_id": "53c6142bd7f45849a4c5c9dfca9b5a04754876c3",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/bn/exponentiation.c"
    },
    {
      "type": "modify",
      "old_id": "76f337cbcadf43c9a15081cc440a9b9b79b9cb0f",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/bn/gcd_extra.c",
      "new_id": "531ff59f3932ed533311a762ede0419ad8342b39",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/bn/gcd_extra.c"
    },
    {
      "type": "modify",
      "old_id": "068d00b480959553bf156ede02258f2e9a038e87",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/bn/montgomery_inv.c",
      "new_id": "499665a5fb06a7af8e9c1db1744585eb7de58ac8",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/bn/montgomery_inv.c"
    },
    {
      "type": "modify",
      "old_id": "7537899c0e0548275930ef5d52c5ffe30bdc79be",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/bn/mul.c",
      "new_id": "07612c5d1f2af10995c77cd500063610c3c95c17",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/bn/mul.c"
    },
    {
      "type": "modify",
      "old_id": "5af6387ed820351e42a2faf629a0fa488ae9548e",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/bn/prime.c",
      "new_id": "4722f80349b8f16f5a55a95a45c4659498e16fe9",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/bn/prime.c"
    },
    {
      "type": "modify",
      "old_id": "06de274a6e38f291cd361fb36e0cf15f0bab93c0",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/bn/random.c",
      "new_id": "f57d1c6a3869298b763fc6b55ba30c5e40e8a424",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/bn/random.c"
    },
    {
      "type": "modify",
      "old_id": "6f9c3bbed4369b43685c2a3a333e201f61cfc7b3",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/rsa/rsa_impl.c",
      "new_id": "099bc02791c4e5bd3ee182a831f21184bf74fa9a",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/rsa/rsa_impl.c"
    },
    {
      "type": "modify",
      "old_id": "aa1436e1c5ed3cc737ffa3a4271556b2716e7a0b",
      "old_mode": 33188,
      "old_path": "crypto/internal.h",
      "new_id": "a77102d7661bd88c24202fee6edf8e19dcb4d78e",
      "new_mode": 33188,
      "new_path": "crypto/internal.h"
    }
  ]
}