Skip to content

Commit e4e1819

Browse files
mrdominomrdomino
authored
Rename random_mod ↦ random_mod_vartime (#1030)
Rejection sampling means that `random_mod` is inherently variable-time, and the current name violates the contract in the `README`: > All functions contained in the crate are designed to execute in > constant time unless explicitly specified otherwise (via a `*_vartime` > name suffix). This renames `random_mod` to `random_mod_vartime`, adding in deprecated aliases at the old names for backwards-compatibility. It preserves the `ConstantTimeLess` functionality for good measure and to not needlessly increase the amount of timing information leaked. Of course, `random_mod` leaks a pretty small amount of timing information; by my reckoning, at worst an average 2 bits per call, and approaching 0 as the modulus approaches `2^n-1`. So this is a bit of an edge case; but I think the `vartime` naming here reduces surprise.
1 parent ba4f0e0 commit e4e1819

File tree

17 files changed

+134
-98
lines changed

17 files changed

+134
-98
lines changed

‎benches/boxed_monty.rs‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,11 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
2525
b.iter_batched(
2626
|| {
2727
let a = BoxedMontyForm::new(
28-
BoxedUint::random_mod(&mut rng, params.modulus().as_nz_ref()),
28+
BoxedUint::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
2929
params.clone(),
3030
);
3131
let b = BoxedMontyForm::new(
32-
BoxedUint::random_mod(&mut rng, params.modulus().as_nz_ref()),
32+
BoxedUint::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
3333
params.clone(),
3434
);
3535
(a, b)
@@ -43,7 +43,7 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
4343
b.iter_batched(
4444
|| {
4545
BoxedMontyForm::new(
46-
BoxedUint::random_mod(&mut rng, params.modulus().as_nz_ref()),
46+
BoxedUint::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
4747
params.clone(),
4848
)
4949
},
@@ -56,11 +56,11 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
5656
b.iter_batched(
5757
|| {
5858
let a = BoxedMontyForm::new(
59-
BoxedUint::random_mod(&mut rng, params.modulus().as_nz_ref()),
59+
BoxedUint::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
6060
params.clone(),
6161
);
6262
let b = BoxedMontyForm::new(
63-
BoxedUint::random_mod(&mut rng, params.modulus().as_nz_ref()),
63+
BoxedUint::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
6464
params.clone(),
6565
);
6666
(a, b)
@@ -74,7 +74,7 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
7474
b.iter_batched(
7575
|| {
7676
BoxedMontyForm::new(
77-
BoxedUint::random_mod(&mut rng, params.modulus().as_nz_ref()),
77+
BoxedUint::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
7878
params.clone(),
7979
)
8080
},
@@ -87,7 +87,7 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
8787
b.iter_batched(
8888
|| {
8989
BoxedMontyForm::new(
90-
BoxedUint::random_mod(&mut rng, params.modulus().as_nz_ref()),
90+
BoxedUint::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
9191
params.clone(),
9292
)
9393
},
@@ -100,11 +100,11 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
100100
b.iter_batched(
101101
|| {
102102
let x = BoxedMontyForm::new(
103-
BoxedUint::random_mod(&mut rng, params.modulus().as_nz_ref()),
103+
BoxedUint::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
104104
params.clone(),
105105
);
106106
let y = BoxedMontyForm::new(
107-
BoxedUint::random_mod(&mut rng, params.modulus().as_nz_ref()),
107+
BoxedUint::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
108108
params.clone(),
109109
);
110110
(x, y)
@@ -165,7 +165,7 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
165165
b.iter_batched(
166166
|| {
167167
BoxedMontyForm::new(
168-
BoxedUint::random_mod(&mut rng, params.modulus().as_nz_ref()),
168+
BoxedUint::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
169169
params.clone(),
170170
)
171171
},

‎benches/const_monty.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ fn bench_montgomery_conversion<M: Measurement>(group: &mut BenchmarkGroup<'_, M>
2121
let mut rng = ChaCha8Rng::from_seed([7u8; 32]);
2222
group.bench_function("ConstMontyForm creation", |b| {
2323
b.iter_batched(
24-
|| U256::random_mod(&mut rng, Modulus::PARAMS.modulus().as_nz_ref()),
24+
|| U256::random_mod_vartime(&mut rng, Modulus::PARAMS.modulus().as_nz_ref()),
2525
|x| black_box(ConstMontyForm::new(&x)),
2626
BatchSize::SmallInput,
2727
)

‎benches/monty.rs‎

Lines changed: 23 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ fn bench_montgomery_conversion<M: Measurement>(group: &mut BenchmarkGroup<'_, M>
3333
let params = MontyParams::new_vartime(Odd::<U256>::random(&mut rng));
3434
group.bench_function("MontyForm::new", |b| {
3535
b.iter_batched(
36-
|| U256::random_mod(&mut rng, params.modulus().as_nz_ref()),
36+
|| U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
3737
|x| black_box(MontyForm::new(&x, params)),
3838
BatchSize::SmallInput,
3939
)
@@ -44,7 +44,7 @@ fn bench_montgomery_conversion<M: Measurement>(group: &mut BenchmarkGroup<'_, M>
4444
b.iter_batched(
4545
|| {
4646
MontyForm::new(
47-
&U256::random_mod(&mut rng, params.modulus().as_nz_ref()),
47+
&U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
4848
params,
4949
)
5050
},
@@ -62,11 +62,11 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
6262
b.iter_batched(
6363
|| {
6464
let a = MontyForm::new(
65-
&U256::random_mod(&mut rng, params.modulus().as_nz_ref()),
65+
&U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
6666
params,
6767
);
6868
let b = MontyForm::new(
69-
&U256::random_mod(&mut rng, params.modulus().as_nz_ref()),
69+
&U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
7070
params,
7171
);
7272
(a, b)
@@ -80,7 +80,7 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
8080
b.iter_batched(
8181
|| {
8282
MontyForm::new(
83-
&U256::random_mod(&mut rng, params.modulus().as_nz_ref()),
83+
&U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
8484
params,
8585
)
8686
},
@@ -93,11 +93,11 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
9393
b.iter_batched(
9494
|| {
9595
let a = MontyForm::new(
96-
&U256::random_mod(&mut rng, params.modulus().as_nz_ref()),
96+
&U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
9797
params,
9898
);
9999
let b = MontyForm::new(
100-
&U256::random_mod(&mut rng, params.modulus().as_nz_ref()),
100+
&U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
101101
params,
102102
);
103103
(a, b)
@@ -111,7 +111,7 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
111111
b.iter_batched(
112112
|| {
113113
MontyForm::new(
114-
&U256::random_mod(&mut rng, params.modulus().as_nz_ref()),
114+
&U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
115115
params,
116116
)
117117
},
@@ -124,7 +124,7 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
124124
b.iter_batched(
125125
|| {
126126
MontyForm::new(
127-
&U256::random_mod(&mut rng, params.modulus().as_nz_ref()),
127+
&U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
128128
params,
129129
)
130130
},
@@ -137,11 +137,11 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
137137
b.iter_batched(
138138
|| {
139139
let x = MontyForm::new(
140-
&U256::random_mod(&mut rng, params.modulus().as_nz_ref()),
140+
&U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
141141
params,
142142
);
143143
let y = MontyForm::new(
144-
&U256::random_mod(&mut rng, params.modulus().as_nz_ref()),
144+
&U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
145145
params,
146146
);
147147
(x, y)
@@ -155,7 +155,7 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
155155
b.iter_batched(
156156
|| {
157157
MontyForm::new(
158-
&U256::random_mod(&mut rng, params.modulus().as_nz_ref()),
158+
&U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref()),
159159
params,
160160
)
161161
},
@@ -167,9 +167,9 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
167167
group.bench_function("modpow, U256^U256", |b| {
168168
b.iter_batched(
169169
|| {
170-
let x = U256::random_mod(&mut rng, params.modulus().as_nz_ref());
170+
let x = U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref());
171171
let x_m = MontyForm::new(&x, params);
172-
let p = U256::random_mod(&mut rng, params.modulus().as_nz_ref())
172+
let p = U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref())
173173
| (U256::ONE << (U256::BITS - 1));
174174
(x_m, p)
175175
},
@@ -181,7 +181,7 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
181181
group.bench_function("div_by_2, U256", |b| {
182182
b.iter_batched(
183183
|| {
184-
let x = U256::random_mod(&mut rng, params.modulus().as_nz_ref());
184+
let x = U256::random_mod_vartime(&mut rng, params.modulus().as_nz_ref());
185185
MontyForm::new(&x, params)
186186
},
187187
|x| black_box(x.div_by_2()),
@@ -198,10 +198,15 @@ fn bench_montgomery_ops<M: Measurement>(group: &mut BenchmarkGroup<'_, M>) {
198198
|| {
199199
let bases_and_exponents: Vec<(MontyForm<{ U256::LIMBS }>, U256)> = (1..=i)
200200
.map(|_| {
201-
let x = U256::random_mod(&mut rng, params.modulus().as_nz_ref());
201+
let x = U256::random_mod_vartime(
202+
&mut rng,
203+
params.modulus().as_nz_ref(),
204+
);
202205
let x_m = MontyForm::new(&x, params);
203-
let p = U256::random_mod(&mut rng, params.modulus().as_nz_ref())
204-
| (U256::ONE << (U256::BITS - 1));
206+
let p = U256::random_mod_vartime(
207+
&mut rng,
208+
params.modulus().as_nz_ref(),
209+
) | (U256::ONE << (U256::BITS - 1));
205210
(x_m, p)
206211
})
207212
.collect();

‎benches/uint.rs‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,10 @@ fn bench_random(c: &mut Criterion) {
1818
let mut group = c.benchmark_group("bounded random");
1919

2020
let mut rng = make_rng();
21-
group.bench_function("random_mod, U1024", |b| {
21+
group.bench_function("random_mod_vartime, U1024", |b| {
2222
let bound = U1024::random(&mut rng);
2323
let bound_nz = NonZero::new(bound).unwrap();
24-
b.iter(|| black_box(U1024::random_mod(&mut rng, &bound_nz)));
24+
b.iter(|| black_box(U1024::random_mod_vartime(&mut rng, &bound_nz)));
2525
});
2626

2727
let mut rng = make_rng();
@@ -38,10 +38,10 @@ fn bench_random(c: &mut Criterion) {
3838
});
3939

4040
let mut rng = make_rng();
41-
group.bench_function("random_mod, U1024, small bound", |b| {
41+
group.bench_function("random_mod_vartime, U1024, small bound", |b| {
4242
let bound = U1024::from_u64(rng.next_u64());
4343
let bound_nz = NonZero::new(bound).unwrap();
44-
b.iter(|| black_box(U1024::random_mod(&mut rng, &bound_nz)));
44+
b.iter(|| black_box(U1024::random_mod_vartime(&mut rng, &bound_nz)));
4545
});
4646

4747
let mut rng = make_rng();
@@ -58,11 +58,11 @@ fn bench_random(c: &mut Criterion) {
5858
});
5959

6060
let mut rng = make_rng();
61-
group.bench_function("random_mod, U1024, 512 bit bound low", |b| {
61+
group.bench_function("random_mod_vartime, U1024, 512 bit bound low", |b| {
6262
let bound = U512::random(&mut rng);
6363
let bound = U1024::from((bound, U512::ZERO));
6464
let bound_nz = NonZero::new(bound).unwrap();
65-
b.iter(|| black_box(U1024::random_mod(&mut rng, &bound_nz)));
65+
b.iter(|| black_box(U1024::random_mod_vartime(&mut rng, &bound_nz)));
6666
});
6767

6868
let mut rng = make_rng();
@@ -80,11 +80,11 @@ fn bench_random(c: &mut Criterion) {
8080
});
8181

8282
let mut rng = make_rng();
83-
group.bench_function("random_mod, U1024, 512 bit bound hi", |b| {
83+
group.bench_function("random_mod_vartime, U1024, 512 bit bound hi", |b| {
8484
let bound = U512::random(&mut rng);
8585
let bound = U1024::from((U512::ZERO, bound));
8686
let bound_nz = NonZero::new(bound).unwrap();
87-
b.iter(|| black_box(U1024::random_mod(&mut rng, &bound_nz)));
87+
b.iter(|| black_box(U1024::random_mod_vartime(&mut rng, &bound_nz)));
8888
});
8989

9090
let mut rng = make_rng();
@@ -103,11 +103,11 @@ fn bench_random(c: &mut Criterion) {
103103

104104
// Slow case: the hi limb is just `2`
105105
let mut rng = make_rng();
106-
group.bench_function("random_mod, U1024, tiny high limb", |b| {
106+
group.bench_function("random_mod_vartime, U1024, tiny high limb", |b| {
107107
let hex_1024 = "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000291A6B42D1C7D2A7184D13E36F65773BBEFB4FA7996101300D49F09962A361F00";
108108
let modulus = U1024::from_be_hex(hex_1024);
109109
let modulus_nz = NonZero::new(modulus).unwrap();
110-
b.iter(|| black_box(U1024::random_mod(&mut rng, &modulus_nz)));
110+
b.iter(|| black_box(U1024::random_mod_vartime(&mut rng, &modulus_nz)));
111111
});
112112

113113
// Slow case: the hi limb is just `2`
@@ -250,7 +250,7 @@ fn bench_mul(c: &mut Criterion) {
250250
b.iter_batched(
251251
|| {
252252
let m = Odd::<U256>::random(&mut rng);
253-
let x = U256::random_mod(&mut rng, m.as_nz_ref());
253+
let x = U256::random_mod_vartime(&mut rng, m.as_nz_ref());
254254
(m.to_nz().unwrap(), x)
255255
},
256256
|(m, x)| black_box(x).mul_mod(black_box(&x), &m),
@@ -262,7 +262,7 @@ fn bench_mul(c: &mut Criterion) {
262262
b.iter_batched(
263263
|| {
264264
let m = Odd::<U256>::random(&mut rng);
265-
let x = U256::random_mod(&mut rng, m.as_nz_ref());
265+
let x = U256::random_mod_vartime(&mut rng, m.as_nz_ref());
266266
(m.to_nz().unwrap(), x)
267267
},
268268
|(m, x)| black_box(x).mul_mod_vartime(black_box(&x), &m),

‎src/lib.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@
146146
//! use crypto_bigint::{NonZero, RandomMod, U256};
147147
//!
148148
//! let modulus = NonZero::new(U256::from(3u8)).unwrap();
149-
//! let n = U256::random_mod(&mut rng(), &modulus);
149+
//! let n = U256::random_mod_vartime(&mut rng(), &modulus);
150150
//! # }
151151
//! ```
152152
//!

‎src/limb/rand.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ impl Random for Limb {
1717
}
1818

1919
impl RandomMod for Limb {
20-
fn try_random_mod<R: TryRngCore + ?Sized>(
20+
fn try_random_mod_vartime<R: TryRngCore + ?Sized>(
2121
rng: &mut R,
2222
modulus: &NonZero<Self>,
2323
) -> Result<Self, R::Error> {

‎src/modular/boxed_monty_form/lincomb.rs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,12 +42,12 @@ mod tests {
4242
for n in 0..100 {
4343
let modulus = Odd::<BoxedUint>::random(&mut rng, SIZE);
4444
let params = BoxedMontyParams::new(modulus.clone());
45-
let a = BoxedUint::random_mod(&mut rng, modulus.as_nz_ref());
46-
let b = BoxedUint::random_mod(&mut rng, modulus.as_nz_ref());
47-
let c = BoxedUint::random_mod(&mut rng, modulus.as_nz_ref());
48-
let d = BoxedUint::random_mod(&mut rng, modulus.as_nz_ref());
49-
let e = BoxedUint::random_mod(&mut rng, modulus.as_nz_ref());
50-
let f = BoxedUint::random_mod(&mut rng, modulus.as_nz_ref());
45+
let a = BoxedUint::random_mod_vartime(&mut rng, modulus.as_nz_ref());
46+
let b = BoxedUint::random_mod_vartime(&mut rng, modulus.as_nz_ref());
47+
let c = BoxedUint::random_mod_vartime(&mut rng, modulus.as_nz_ref());
48+
let d = BoxedUint::random_mod_vartime(&mut rng, modulus.as_nz_ref());
49+
let e = BoxedUint::random_mod_vartime(&mut rng, modulus.as_nz_ref());
50+
let f = BoxedUint::random_mod_vartime(&mut rng, modulus.as_nz_ref());
5151

5252
let std = a
5353
.mul_mod(&b, modulus.as_nz_ref())

‎src/modular/const_monty_form.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,7 +226,7 @@ where
226226
{
227227
#[inline]
228228
fn try_random<R: TryRngCore + ?Sized>(rng: &mut R) -> Result<Self, R::Error> {
229-
Ok(Self::new(&Uint::try_random_mod(
229+
Ok(Self::new(&Uint::try_random_mod_vartime(
230230
rng,
231231
MOD::PARAMS.modulus.as_nz_ref(),
232232
)?))

‎src/modular/const_monty_form/lincomb.rs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,12 @@ mod tests {
3737

3838
let mut rng = chacha20::ChaCha8Rng::seed_from_u64(1);
3939
for n in 0..1000 {
40-
let a = U256::random_mod(&mut rng, modulus);
41-
let b = U256::random_mod(&mut rng, modulus);
42-
let c = U256::random_mod(&mut rng, modulus);
43-
let d = U256::random_mod(&mut rng, modulus);
44-
let e = U256::random_mod(&mut rng, modulus);
45-
let f = U256::random_mod(&mut rng, modulus);
40+
let a = U256::random_mod_vartime(&mut rng, modulus);
41+
let b = U256::random_mod_vartime(&mut rng, modulus);
42+
let c = U256::random_mod_vartime(&mut rng, modulus);
43+
let d = U256::random_mod_vartime(&mut rng, modulus);
44+
let e = U256::random_mod_vartime(&mut rng, modulus);
45+
let f = U256::random_mod_vartime(&mut rng, modulus);
4646

4747
assert_eq!(
4848
a.mul_mod(&b, modulus)

‎src/modular/monty_form/lincomb.rs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,10 +43,10 @@ mod tests {
4343
let modulus = Odd::<U256>::random(&mut rng);
4444
let params = MontyParams::new_vartime(modulus);
4545
let m = modulus.as_nz_ref();
46-
let a = U256::random_mod(&mut rng, m);
47-
let b = U256::random_mod(&mut rng, m);
48-
let c = U256::random_mod(&mut rng, m);
49-
let d = U256::random_mod(&mut rng, m);
46+
let a = U256::random_mod_vartime(&mut rng, m);
47+
let b = U256::random_mod_vartime(&mut rng, m);
48+
let c = U256::random_mod_vartime(&mut rng, m);
49+
let d = U256::random_mod_vartime(&mut rng, m);
5050

5151
assert_eq!(
5252
a.mul_mod(&b, m).add_mod(&c.mul_mod(&d, m), m),

0 commit comments

Comments
 (0)