curve!: use constant-time compressed Ristretto equality testing #669
Conversation
|
Note that dalek-cryptography/subtle#131 would also supply a marker trait that could be useful here to signal this "all equality is constant time" behavior. |
curve25519-dalek/src/ristretto.rs
Outdated
| #[derive(Copy, Clone, Eq, PartialEq, Hash)] | ||
| #[derive(Copy, Clone, Hash)] |
There was a problem hiding this comment.
While it's unlikely to cause real-world breakages, I believe this is technically a breaking change.
Here's an example of what is possible with a derived PartialEq which won't be possible with this change: https://play.rust-lang.org/?version=stable&mode=debug&edition=2021&gist=33e85cff0772c968767a0417a8a7a541
There was a problem hiding this comment.
Interesting! I was not aware of this behavior. Thoughts on the tradeoff between the functionality and the implications of the breaking change?
There was a problem hiding this comment.
I would strongly agree with making this change if it weren't for the potential breakages
There was a problem hiding this comment.
Ought this PR stay open until the next breaking release? I remain of the opinion that the benefit (consistency with safety goals) outweighs the cost.
AaronFeickert
force-pushed
the
compressed-eq-is-ct
branch
2 times, most recently
from
e03cc24 to
326eeda
Compare
|
Yeah that's unfortunate. I really doubt anyone has ever used a |
AaronFeickert
force-pushed
the
compressed-eq-is-ct
branch
from
326eeda to
f36fd77
Compare
|
Given that this seems to be a desired change, I'll keep it open for the next breaking release. Feel free to close if this isn't the case! |
AaronFeickert
changed the title
AaronFeickert
changed the title
In line with the safety goals, this PR ensures that
CompressedRistrettoequality testing is always done in constant time.Previous work in #229 implemented
ConstantTimeEqforCompressedRistretto, but this is not used forEqequality testing. It's already the case thatRistrettoPointandScalarperform all equality testing in constant time; this PR unifies this behavior for compressed points as well.BREAKING CHANGE: As noted by @tarcieri, this can break certain uses of
match.