tree 67383c77f531626f229754488d24c7a20ef92c1a
parent a49c617197b577f1f92153a295c11c762cd929f8
author David Benjamin <davidben@google.com> 1586287103 -0400
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1586444628 +0000

Make ec_GFp_simple_is_on_curve constant-time.

This function (by way of EC_POINT_is_on_curve) is used by callers in two
places:

- To check the affine result of decoding a point. (This is no longer
  necessary because we'll always do it internally, but folks still do
  it.)

- To check the Jacobian result of a multiplication as fault protection.
  (Tink does this. We should probably do it in the library.)

That function's implementations of affine and Jacobian checks are mostly
constant-time, but branching between the two isn't. Since the difference
is small (2S + 1M vs 2S + 3M) compared to what one would be doing with
an affine point (point multiplication), this probably isn't worth
worrying about. Conservatively do the Jacobian check so folks like Tink
aren't accidentally introducing side channels.

Change-Id: I3140167868e027004906293df547add43ae40552
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40590
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>