From 4370c62f438be93892af34474e07225a0644e1d0 Mon Sep 17 00:00:00 2001 From: Tony Arcieri Date: Wed, 10 Sep 2025 15:54:06 -0600 Subject: [PATCH] [WIP] ctutils --- .github/workflows/ctutils.yml | 66 +++++++++++ Cargo.lock | 7 ++ Cargo.toml | 4 + ctutils/CHANGELOG.md | 5 + ctutils/Cargo.toml | 20 ++++ ctutils/LICENSE-APACHE | 202 ++++++++++++++++++++++++++++++++++ ctutils/LICENSE-MIT | 25 +++++ ctutils/README.md | 92 ++++++++++++++++ ctutils/src/choice.rs | 195 ++++++++++++++++++++++++++++++++ ctutils/src/lib.rs | 13 +++ ctutils/src/traits.rs | 86 +++++++++++++++ 11 files changed, 715 insertions(+) create mode 100644 .github/workflows/ctutils.yml create mode 100644 ctutils/CHANGELOG.md create mode 100644 ctutils/Cargo.toml create mode 100644 ctutils/LICENSE-APACHE create mode 100644 ctutils/LICENSE-MIT create mode 100644 ctutils/README.md create mode 100644 ctutils/src/choice.rs create mode 100644 ctutils/src/lib.rs create mode 100644 ctutils/src/traits.rs diff --git a/.github/workflows/ctutils.yml b/.github/workflows/ctutils.yml new file mode 100644 index 00000000..757dd1d8 --- /dev/null +++ b/.github/workflows/ctutils.yml @@ -0,0 +1,66 @@ +name: ctutils + +on: + pull_request: + paths: + - ".github/workflows/ctutils.yml" + - "ctutils/**" + - "Cargo.*" + push: + branches: master + +permissions: + contents: read + +defaults: + run: + working-directory: ctutils + +env: + CARGO_INCREMENTAL: 0 + RUSTFLAGS: "-Dwarnings" + +# Cancels CI jobs when new commits are pushed to a PR branch +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +jobs: + build: + runs-on: ubuntu-latest + strategy: + matrix: + rust: + - 1.85.0 # MSRV + - stable + target: + - thumbv7em-none-eabi + - wasm32-unknown-unknown + steps: + - uses: actions/checkout@v5 + - uses: RustCrypto/actions/cargo-cache@master + - uses: dtolnay/rust-toolchain@master + with: + toolchain: ${{ matrix.rust }} + targets: ${{ matrix.target }} + - run: cargo build --target ${{ matrix.target }} + + minimal-versions: + uses: RustCrypto/actions/.github/workflows/minimal-versions.yml@master + with: + working-directory: ${{ github.workflow }} + + test: + runs-on: ubuntu-latest + strategy: + matrix: + rust: + - 1.85.0 # MSRV + - stable + steps: + - uses: actions/checkout@v5 + - uses: RustCrypto/actions/cargo-cache@master + - uses: dtolnay/rust-toolchain@master + with: + toolchain: ${{ matrix.rust }} + - run: cargo test diff --git a/Cargo.lock b/Cargo.lock index 2e9140ad..3185726f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -76,6 +76,13 @@ dependencies = [ "hybrid-array 0.3.1", ] +[[package]] +name = "ctutils" +version = "0.0.0" +dependencies = [ + "cmov", +] + [[package]] name = "dbl" version = "0.5.0" diff --git a/Cargo.toml b/Cargo.toml index cf2ec7f1..f060d7fb 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -6,6 +6,7 @@ members = [ "block-padding", "collectable", "cmov", + "ctutils", "cpufeatures", "dbl", "digest-io", @@ -21,3 +22,6 @@ exclude = ["aarch64-dit"] [profile.dev] opt-level = 2 + +[patch.crates-io] +cmov = { path = "cmov" } diff --git a/ctutils/CHANGELOG.md b/ctutils/CHANGELOG.md new file mode 100644 index 00000000..d6637e04 --- /dev/null +++ b/ctutils/CHANGELOG.md @@ -0,0 +1,5 @@ +# Changelog +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). diff --git a/ctutils/Cargo.toml b/ctutils/Cargo.toml new file mode 100644 index 00000000..be5a6d06 --- /dev/null +++ b/ctutils/Cargo.toml @@ -0,0 +1,20 @@ +[package] +name = "ctutils" +description = """ +Constant-time utility library with `const fn` support targeting cryptographic +applications. Built on the `cmov` crate which provides architecture-specific +predication intrinsics. Heavily inspired by the `subtle` crate. +""" +version = "0.0.0" +authors = ["RustCrypto Developers"] +license = "Apache-2.0 OR MIT" +homepage = "https://github.com/RustCrypto/utils/tree/master/ctselect" +repository = "https://github.com/RustCrypto/utils" +categories = ["cryptography", "no-std"] +keywords = ["crypto", "intrinsics"] +readme = "README.md" +edition = "2024" +rust-version = "1.85" + +[dependencies] +cmov = "0.4" diff --git a/ctutils/LICENSE-APACHE b/ctutils/LICENSE-APACHE new file mode 100644 index 00000000..d6456956 --- /dev/null +++ b/ctutils/LICENSE-APACHE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/ctutils/LICENSE-MIT b/ctutils/LICENSE-MIT new file mode 100644 index 00000000..82a58781 --- /dev/null +++ b/ctutils/LICENSE-MIT @@ -0,0 +1,25 @@ +Copyright (c) 2025 The RustCrypto Project Developers + +Permission is hereby granted, free of charge, to any +person obtaining a copy of this software and associated +documentation files (the "Software"), to deal in the +Software without restriction, including without +limitation the rights to use, copy, modify, merge, +publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software +is furnished to do so, subject to the following +conditions: + +The above copyright notice and this permission notice +shall be included in all copies or substantial portions +of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF +ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED +TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A +PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT +SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR +IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. diff --git a/ctutils/README.md b/ctutils/README.md new file mode 100644 index 00000000..a5991283 --- /dev/null +++ b/ctutils/README.md @@ -0,0 +1,92 @@ +# [RustCrypto]: CMOV (Conditional Move) + +[![Crate][crate-image]][crate-link] +[![Docs][docs-image]][docs-link] +[![Build Status][build-image]][build-link] +![Apache 2.0/MIT Licensed][license-image] +![MSRV][msrv-image] + +Conditional move CPU intrinsics which are guaranteed to execute in +constant-time and not be rewritten as branches by the compiler. + +Provides wrappers for the [CMOV family] of instructions on x86/x86_64 and +the [CSEL] instruction on AArch64 CPUs, along with a portable fallback +implementation for other CPU architectures. + +[Documentation][docs-link] + +## About + +Conditional move intrinsics provide [predication] which allows selection +of one or more values without using branch instructions, thus making the +selection constant-time with respect to the values, and not subject to CPU +execution features which might introduce timing or other microarchitectural +sidechannels introduced by branch prediction or other speculative execution +features. + +Intel has confirmed that all extant CPUs implement the CMOV family of +instructions in constant-time, and that this property will hold for future +Intel CPUs as well. + +This crate provides wrappers for the CMOV/CSEL instructions implemented using +inline assembly as stabilized in Rust 1.59. This means the implementation +is a black box that will not be rewritten by e.g. LLVM's architecture-specific +lowerings, such as the [x86-cmov-conversion] pass. + +## Supported target architectures + +This crate provides guaranteed constant-time operation using inline assembly +on the following CPU architectures: + +- [x] `x86` (`CMOVZ`, `CMOVNZ`) +- [x] `x86_64` (`CMOVZ`, `CMOVNZ`) +- [x] `aarch64` (`CSEL`) + +On other target architectures, a "best effort" portable fallback implementation +based on bitwise arithmetic is used instead. However, we cannot guarantee that +this implementation generates branch-free code. + +It's possible to extend constant-time guarantees to other CPU architectures. +Please open an issue with your desired CPU architecture if this interests you. + +## Minimum Supported Rust Version + +Rust **1.85** or newer. + +In the future, we reserve the right to change MSRV (i.e. MSRV is out-of-scope +for this crate's SemVer guarantees), however when we do it will be accompanied by +a minor version bump. + +## License + +Licensed under either of: + +* [Apache License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0) +* [MIT license](http://opensource.org/licenses/MIT) + +at your option. + +### Contribution + +Unless you explicitly state otherwise, any contribution intentionally submitted +for inclusion in the work by you, as defined in the Apache-2.0 license, shall be +dual licensed as above, without any additional terms or conditions. + +[//]: # (badges) + +[crate-image]: https://img.shields.io/crates/v/cmov.svg +[crate-link]: https://crates.io/crates/cmov +[docs-image]: https://docs.rs/cmov/badge.svg +[docs-link]: https://docs.rs/cmov/ +[license-image]: https://img.shields.io/badge/license-Apache2.0/MIT-blue.svg +[msrv-image]: https://img.shields.io/badge/rustc-1.85+-blue.svg +[build-image]: https://github.com/RustCrypto/utils/actions/workflows/cmov.yml/badge.svg?branch=master +[build-link]: https://github.com/RustCrypto/utils/actions/workflows/cmov.yml?query=branch:master + +[//]: # (general links) + +[RustCrypto]: https://github.com/RustCrypto +[CMOV family]: https://www.jaist.ac.jp/iscenter-new/mpc/altix/altixdata/opt/intel/vtune/doc/users_guide/mergedProjects/analyzer_ec/mergedProjects/reference_olh/mergedProjects/instructions/instruct32_hh/vc35.htm +[CSEL]: https://developer.arm.com/documentation/dui0802/b/CSEL +[predication]: https://en.wikipedia.org/wiki/Predication_(computer_architecture) +[x86-cmov-conversion]: https://dsprenkels.com/cmov-conversion.html diff --git a/ctutils/src/choice.rs b/ctutils/src/choice.rs new file mode 100644 index 00000000..11257418 --- /dev/null +++ b/ctutils/src/choice.rs @@ -0,0 +1,195 @@ +use core::ops::{BitAnd, BitAndAssign, BitOr, BitOrAssign, BitXor, BitXorAssign, Not}; + +/// Constant-time analogue of `bool` providing a "best effort" optimization barrier. +/// +/// Attempts to hint to the compiler and its codegen backends that optimizations should not be +/// applied which depend on a value prior to accessing it though [`BlackBox::get`]. +/// +/// This is used as a "belt-and-suspenders" defense in addition to rhs mechanisms like +/// constant-time predication intrinsics, and is never expected to be the only line of defense. +#[derive(Copy, Clone, Debug)] +pub struct Choice(u8); + +impl Choice { + /// The falsy value. + pub const FALSE: Self = Self(0); + + /// The truthy value. + pub const TRUE: Self = Self(1); + + /// Create a new [`Choice`] from the given `u8` value, which should be either `0` or `1`. + #[inline] + pub const fn new(value: u8) -> Self { + debug_assert!(value == 0 || value == 1, "Choice::new accepts only 0 or 1"); + Self(value) + } + + /// Convert `Choice` into a `bool`. + /// + /// # ⚠️ Security Note + /// + /// This is intended to be used as either the one and only branch at the end of a constant-time + /// operation to e.g. differentiate between success and failure, or in contexts where + /// constant-time doesn't matter, e.g. vartime code that operates on "maybe secret" types which + /// aren't secrets in a particular context. + // TODO(tarcieri): `const fn` when MSRV 1.86 + pub fn to_bool(self) -> bool { + self.to_u8() != 0 + } + + /// Convert [`Choice`] to a `u8`, attempting to apply an optimization barrier if possible. + // TODO(tarcieri): `const fn` when MSRV 1.86 + pub fn to_u8(self) -> u8 { + // `black_box` is documented as working on a "best effort" basis. That's fine, this type is + // likewise documented as only working on a "best effort" basis itself. The only way we + // rely on `black_box` for correctness is it behaving as the identity function. + core::hint::black_box(self.0) + } + + /// Apply an `and` conditional to the given [`Choice`]s. + #[inline] + pub const fn and(self, rhs: Choice) -> Choice { + Self(self.0 & rhs.0) + } + + /// Apply an `or` conditional to the given [`Choice`]s. + #[inline] + pub const fn or(self, rhs: Choice) -> Choice { + Self(self.0 | rhs.0) + } + + /// Apply an `xor` conditional to the given [`Choice`]s. + #[inline] + pub const fn xor(self, rhs: Choice) -> Choice { + Self(self.0 ^ rhs.0) + } + + /// Compute the boolean inverse of `self`. + #[inline] + pub const fn not(self) -> Choice { + // NOTE: assumes self.0 is `0` or `1` as checked in constructor + Self(self.0 ^ 1) + } +} + +impl BitAnd for Choice { + type Output = Choice; + + #[inline] + fn bitand(self, rhs: Choice) -> Choice { + self.and(rhs) + } +} + +impl BitAndAssign for Choice { + #[inline] + fn bitand_assign(&mut self, rhs: Choice) { + *self = *self & rhs; + } +} + +impl BitOr for Choice { + type Output = Choice; + + #[inline] + fn bitor(self, rhs: Choice) -> Choice { + self.or(rhs) + } +} + +impl BitOrAssign for Choice { + #[inline] + fn bitor_assign(&mut self, rhs: Choice) { + *self = *self | rhs; + } +} + +impl BitXor for Choice { + type Output = Choice; + + #[inline] + fn bitxor(self, rhs: Choice) -> Choice { + (self.0 ^ rhs.0).into() + } +} + +impl BitXorAssign for Choice { + #[inline] + fn bitxor_assign(&mut self, rhs: Choice) { + *self = *self ^ rhs; + } +} + +impl From for Choice { + fn from(value: u8) -> Self { + Self::new(value) + } +} + +impl From for u8 { + fn from(choice: Choice) -> u8 { + choice.to_u8() + } +} + +impl From for bool { + fn from(choice: Choice) -> bool { + choice.to_bool() + } +} + +impl Not for Choice { + type Output = Choice; + + #[inline] + fn not(self) -> Choice { + self.not() + } +} + +#[cfg(test)] +mod tests { + use super::Choice; + + #[test] + fn to_bool() { + assert_eq!(Choice::new(0).to_bool(), false); + assert_eq!(Choice::new(1).to_bool(), true); + } + + #[test] + fn to_u8() { + assert_eq!(Choice::new(0).to_u8(), 0); + assert_eq!(Choice::new(1).to_u8(), 1); + } + + #[test] + fn and() { + assert_eq!((Choice::new(0) & Choice::new(0)).to_u8(), 0); + assert_eq!((Choice::new(1) & Choice::new(0)).to_u8(), 0); + assert_eq!((Choice::new(0) & Choice::new(1)).to_u8(), 0); + assert_eq!((Choice::new(1) & Choice::new(1)).to_u8(), 1); + } + + #[test] + fn or() { + assert_eq!((Choice::new(0) | Choice::new(0)).to_u8(), 0); + assert_eq!((Choice::new(1) | Choice::new(0)).to_u8(), 1); + assert_eq!((Choice::new(0) | Choice::new(1)).to_u8(), 1); + assert_eq!((Choice::new(1) | Choice::new(1)).to_u8(), 1); + } + + #[test] + fn xor() { + assert_eq!((Choice::new(0) ^ Choice::new(0)).to_u8(), 0); + assert_eq!((Choice::new(1) ^ Choice::new(0)).to_u8(), 1); + assert_eq!((Choice::new(0) ^ Choice::new(1)).to_u8(), 1); + assert_eq!((Choice::new(1) ^ Choice::new(1)).to_u8(), 0); + } + + #[test] + fn not() { + assert_eq!(Choice::new(0).not().to_u8(), 1); + assert_eq!(Choice::new(1).not().to_u8(), 0); + } +} diff --git a/ctutils/src/lib.rs b/ctutils/src/lib.rs new file mode 100644 index 00000000..f45c8d66 --- /dev/null +++ b/ctutils/src/lib.rs @@ -0,0 +1,13 @@ +#![no_std] +#![doc = include_str!("../README.md")] +#![doc( + html_logo_url = "https://raw.githubusercontent.com/RustCrypto/meta/master/logo.svg", + html_favicon_url = "https://raw.githubusercontent.com/RustCrypto/meta/master/logo.svg" +)] +#![warn(missing_docs, unused_qualifications)] + +mod choice; +mod traits; + +pub use choice::Choice; +pub use traits::*; diff --git a/ctutils/src/traits.rs b/ctutils/src/traits.rs new file mode 100644 index 00000000..7913c34f --- /dev/null +++ b/ctutils/src/traits.rs @@ -0,0 +1,86 @@ +use crate::Choice; +use cmov::CmovEq; +use core::cmp; + +/// `Eq` with `Choice` instead of bool`. +pub trait CtEq { + /// Equality + fn ct_eq(&self, other: &Self) -> Choice; + + /// Inequality + fn ct_ne(&self, other: &Self) -> Choice { + !self.ct_eq(other) + } +} + +macro_rules! impl_cteq_with_cmov { + ( $($uint:ty),+ ) => { + $( + impl CtEq for $uint { + #[inline] + fn ct_eq(&self, other: &Self) -> Choice { + let mut ret = 0; + self.cmoveq(other, 1, &mut ret); + ret.into() + } + } + )+ + }; +} + +impl_cteq_with_cmov!(u8, u16, u32, u64, u128); + +impl CtEq for bool { + #[inline] + fn ct_eq(&self, other: &Self) -> Choice { + u8::from(*self).ct_eq(&u8::from(*other)) + } +} + +#[cfg(any(target_pointer_width = "32", target_pointer_width = "64"))] +impl CtEq for usize { + #[cfg(target_pointer_width = "32")] + fn ct_eq(&self, other: &Self) -> Choice { + (*self as u32).ct_eq(&(*other as u32)) + } + + #[cfg(target_pointer_width = "64")] + fn ct_eq(&self, other: &Self) -> Choice { + (*self as u64).ct_eq(&(*other as u64)) + } +} + +impl CtEq for Choice { + #[inline] + fn ct_eq(&self, rhs: &Choice) -> Choice { + !(*self ^ *rhs) + } +} + +impl CtEq for cmp::Ordering { + #[inline] + fn ct_eq(&self, other: &Self) -> Choice { + // `Ordering` is `repr(i8)`, however we don't impl `CtEq` for `i8` (though we could easily). + // Instead, this casts `Ordering` to a `u8`, which preserves bit pattern equality. Then we + // are able to use the `ct_eq` impl on `u8`, which is backed by `cmov`. + (*self as u8).ct_eq(&(*other as u8)) + } +} + +impl CtEq for [T] { + /// Compare slices in constant time. + /// + /// NOTE: exits early in the event of a length mismatch. + #[inline] + fn ct_eq(&self, rhs: &[T]) -> Choice { + if self.len() != rhs.len() { + return Choice::FALSE; + } + + let mut ret = Choice::TRUE; + for (a, b) in self.iter().zip(rhs.iter()) { + ret &= a.ct_eq(b); + } + ret + } +}