Fix #1363: Recommendation R17 - Constant timing in ECDH

LedgerHQ · Oct 18, 2022 · 61aba38 · 61aba38
1 parent 166c500
commit 61aba38
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/lib_cxng/src/cx_ecdh.c b/lib_cxng/src/cx_ecdh.c
@@ -84,7 +84,11 @@ cx_err_t cx_ecdh_no_throw(const cx_ecfp_private_key_t *key,
   CX_CHECK(cx_ecpoint_alloc(&W, curve));
   CX_CHECK(cx_ecpoint_init(&W, public_point + 1, sz, public_point + 1 + sz, sz));
   // Scalar multiplication with random projective coordinates and additive splitting
-  CX_CHECK(cx_ecpoint_rnd_scalarmul(&W, key->d, key->d_len));
+  if (CX_CURVE_RANGE(curve, WEIERSTRASS)) {
+    CX_CHECK(cx_ecpoint_rnd_fixed_scalarmul(&W, key->d, key->d_len));
+  } else {
+    CX_CHECK(cx_ecpoint_rnd_scalarmul(&W, key->d, key->d_len));
+  }
   switch (mode & CX_MASK_EC) {
   case CX_ECDH_POINT:
     secret[0] = 0x04;

diff --git a/lib_cxng/src/cx_ecfp.c b/lib_cxng/src/cx_ecfp.c
@@ -190,7 +190,7 @@ cx_err_t cx_ecfp_generate_pair2_no_throw(cx_curve_t             curve,
   if (CX_CURVE_RANGE(curve, WEIERSTRASS)) {
     CX_CHECK(cx_ecpoint_alloc(&W, private_key->curve));
     CX_CHECK(cx_ecdomain_generator_bn(curve, &W));
-    CX_CHECK(cx_ecpoint_rnd_scalarmul(&W, private_key->d, private_key->d_len));
+    CX_CHECK(cx_ecpoint_rnd_fixed_scalarmul(&W, private_key->d, private_key->d_len));
     public_key->curve = curve;
     public_key->W_len = 1 + 2 * size;
     public_key->W[0]  = 0x04;