tree db7d5c217348cb6b9466979d19cd8b3350ab2968
parent f883b98cfda809cb4dc42b5907129dbfb9273a06
author David Benjamin <davidben@google.com> 1586800581 -0400
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1586813624 +0000

Make ec_GFp_simple_cmp constant-time.

We need a constant-time point equality for two reasons. First, although
multiplication results are usually public, their Jacobian Z coordinates
may be secret, or at least are not obviously public. Second, more
complex protocols will sometimes manipulate secret points, notably
PMBTokens.

While here I've renamed the inner function to points_equal without the
flipped return value, to be less confusing.

Update-Note: This does mean that we pay a 6M+2S Jacobian comparison
where comparing two publicly affine points should cost no field
operations at all. Code which compares two EC public keys for equality
will be slightly slower. I wouldn't expect this to matter (if you
actually use the public keys, you'll pay much much more) If it does, we
can restore this optimization by keeping better track of affine vs.
Jacobian forms. See https://crbug.com/boringssl/326.

Bug: 326, chromium:1014199
Change-Id: I67c9a56bc9b66f30c0b500a29e8bf90427d89061
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40665
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>