1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

//! Constant-time comparison helpers for [`ByteArray`].

use crate::{ArrayLength, ByteArray};
use subtle::{Choice, ConditionallySelectable, ConstantTimeEq};

/// Constant-time equals.
pub(crate) fn ct_eq<N: ArrayLength<u8>>(a: &ByteArray<N>, b: &ByteArray<N>) -> Choice {
    let mut ret = Choice::from(1);

    for (a, b) in a.iter().zip(b.iter()) {
        ret.conditional_assign(&Choice::from(0), !a.ct_eq(b));
    }

    ret
}

/// Constant-time less than.
///
/// Inputs are interpreted as big endian integers.
pub(crate) fn ct_lt<N: ArrayLength<u8>>(a: &ByteArray<N>, b: &ByteArray<N>) -> Choice {
    let mut borrow = 0;

    // Perform subtraction with borrow a byte-at-a-time, interpreting a
    // no-borrow condition as the less-than case
    for (&a, &b) in a.iter().zip(b.iter()).rev() {
        let c = (b as u16).wrapping_add(borrow >> (u8::BITS - 1));
        borrow = (a as u16).wrapping_sub(c) >> u8::BITS as u8;
    }

    !borrow.ct_eq(&0)
}

#[cfg(test)]
mod tests {
    const A: [u8; 4] = [0, 0, 0, 0];
    const B: [u8; 4] = [0, 0, 0, 1];
    const C: [u8; 4] = [0xFF, 0, 0, 0];
    const D: [u8; 4] = [0xFF, 0, 0, 1];
    const E: [u8; 4] = [0xFF, 0xFF, 0xFF, 0xFE];
    const F: [u8; 4] = [0xFF, 0xFF, 0xFF, 0xFF];

    #[test]
    fn ct_eq() {
        use super::ct_eq;

        assert_eq!(ct_eq(&A.into(), &A.into()).unwrap_u8(), 1);
        assert_eq!(ct_eq(&B.into(), &B.into()).unwrap_u8(), 1);
        assert_eq!(ct_eq(&C.into(), &C.into()).unwrap_u8(), 1);
        assert_eq!(ct_eq(&D.into(), &D.into()).unwrap_u8(), 1);
        assert_eq!(ct_eq(&E.into(), &E.into()).unwrap_u8(), 1);
        assert_eq!(ct_eq(&F.into(), &F.into()).unwrap_u8(), 1);

        assert_eq!(ct_eq(&A.into(), &B.into()).unwrap_u8(), 0);
        assert_eq!(ct_eq(&C.into(), &D.into()).unwrap_u8(), 0);
        assert_eq!(ct_eq(&E.into(), &F.into()).unwrap_u8(), 0);
    }

    #[test]
    fn ct_lt() {
        use super::ct_lt;

        assert_eq!(ct_lt(&A.into(), &A.into()).unwrap_u8(), 0);
        assert_eq!(ct_lt(&B.into(), &B.into()).unwrap_u8(), 0);
        assert_eq!(ct_lt(&C.into(), &C.into()).unwrap_u8(), 0);
        assert_eq!(ct_lt(&D.into(), &D.into()).unwrap_u8(), 0);
        assert_eq!(ct_lt(&E.into(), &E.into()).unwrap_u8(), 0);
        assert_eq!(ct_lt(&F.into(), &F.into()).unwrap_u8(), 0);

        assert_eq!(ct_lt(&A.into(), &B.into()).unwrap_u8(), 1);
        assert_eq!(ct_lt(&A.into(), &C.into()).unwrap_u8(), 1);
        assert_eq!(ct_lt(&B.into(), &A.into()).unwrap_u8(), 0);
        assert_eq!(ct_lt(&C.into(), &A.into()).unwrap_u8(), 0);

        assert_eq!(ct_lt(&B.into(), &C.into()).unwrap_u8(), 1);
        assert_eq!(ct_lt(&B.into(), &D.into()).unwrap_u8(), 1);
        assert_eq!(ct_lt(&C.into(), &B.into()).unwrap_u8(), 0);
        assert_eq!(ct_lt(&D.into(), &B.into()).unwrap_u8(), 0);

        assert_eq!(ct_lt(&C.into(), &D.into()).unwrap_u8(), 1);
        assert_eq!(ct_lt(&C.into(), &E.into()).unwrap_u8(), 1);
        assert_eq!(ct_lt(&D.into(), &C.into()).unwrap_u8(), 0);
        assert_eq!(ct_lt(&E.into(), &C.into()).unwrap_u8(), 0);

        assert_eq!(ct_lt(&E.into(), &F.into()).unwrap_u8(), 1);
        assert_eq!(ct_lt(&F.into(), &E.into()).unwrap_u8(), 0);
    }
}