From a0828c029a958e0f853b1a88e7a60ffd6bba793c Mon Sep 17 00:00:00 2001 From: Tony Arcieri Date: Wed, 17 Dec 2025 18:15:39 -0700 Subject: [PATCH] ctutils: constant-time selection and equality testing Inspired by the `subtle` crate, this is a next-generation constant time utility crate built on the `cmov` crate's constant-time selection/predication and equality comparisons, which are exposed as `CtSelect` and `CtEq` traits (equivalent to `ConditionallySelectable` and `ConstantTimeEq` in `subtle`). Additionally, it uses `black_box` as a "best effort" optimization barrier whenever accessing its constant time conditional type (called `Choice` as in `subtle`), providing an additional line of defense against possible future compiler optimizations. It also has a `CtOption` type like `subtle` which provides a constant-time equivalent to `Option` but with combinators that are evaluated eagerly rather than lazily so they behave the same regardless of the effective absence or presence of the underlying value. It proactively makes functions `const fn` wherever possible, making it possible to construct and use `Choice` and `CtOption` in these contexts. The `Copy` bounds have been removed, making it possible for everything to be used on heap-allocated types, such as `BoxedUint` in `crypto-bigint`. The above two issues taken together are the main reasons why `crypto-bigint` currently embeds its own mini-`subtle` alike, which it would be nice to use this library to replace. --- .github/workflows/cmov.yml | 11 +- .github/workflows/ctutils.yml | 75 +++++ Cargo.lock | 7 + Cargo.toml | 4 + cmov/README.md | 2 +- ctutils/CHANGELOG.md | 5 + ctutils/Cargo.toml | 20 ++ ctutils/LICENSE-APACHE | 202 +++++++++++ ctutils/LICENSE-MIT | 25 ++ ctutils/README.md | 67 ++++ ctutils/src/choice.rs | 238 +++++++++++++ ctutils/src/ct_option.rs | 574 ++++++++++++++++++++++++++++++++ ctutils/src/lib.rs | 73 ++++ ctutils/src/traits.rs | 7 + ctutils/src/traits/ct_eq.rs | 158 +++++++++ ctutils/src/traits/ct_select.rs | 146 ++++++++ 16 files changed, 1612 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/ctutils.yml create mode 100644 ctutils/CHANGELOG.md create mode 100644 ctutils/Cargo.toml create mode 100644 ctutils/LICENSE-APACHE create mode 100644 ctutils/LICENSE-MIT create mode 100644 ctutils/README.md create mode 100644 ctutils/src/choice.rs create mode 100644 ctutils/src/ct_option.rs create mode 100644 ctutils/src/lib.rs create mode 100644 ctutils/src/traits.rs create mode 100644 ctutils/src/traits/ct_eq.rs create mode 100644 ctutils/src/traits/ct_select.rs diff --git a/.github/workflows/cmov.yml b/.github/workflows/cmov.yml index ff3407dc..6f7fcd85 100644 --- a/.github/workflows/cmov.yml +++ b/.github/workflows/cmov.yml @@ -87,8 +87,17 @@ jobs: - run: ${{ matrix.deps }} - run: cargo test --target ${{ matrix.target }} + # Test using `cargo careful` + test-careful: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + - uses: dtolnay/rust-toolchain@nightly + - run: cargo install cargo-careful + - run: cargo careful test --all-features + # Cross-compiled tests - cross: + test-cross: strategy: matrix: include: diff --git a/.github/workflows/ctutils.yml b/.github/workflows/ctutils.yml new file mode 100644 index 00000000..349c3dca --- /dev/null +++ b/.github/workflows/ctutils.yml @@ -0,0 +1,75 @@ +name: ctutils + +on: + pull_request: + paths: + - ".github/workflows/ctutils.yml" + - "ctutils/**" + - "Cargo.*" + push: + branches: master + +permissions: + contents: read + +defaults: + run: + working-directory: ctutils + +env: + CARGO_INCREMENTAL: 0 + RUSTFLAGS: "-Dwarnings" + +# Cancels CI jobs when new commits are pushed to a PR branch +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +jobs: + build: + runs-on: ubuntu-latest + strategy: + matrix: + rust: + - 1.87.0 # MSRV + - stable + target: + - thumbv7em-none-eabi + - wasm32-unknown-unknown + steps: + - uses: actions/checkout@v5 + - uses: RustCrypto/actions/cargo-cache@master + - uses: dtolnay/rust-toolchain@master + with: + toolchain: ${{ matrix.rust }} + targets: ${{ matrix.target }} + - run: cargo build --target ${{ matrix.target }} + + minimal-versions: + uses: RustCrypto/actions/.github/workflows/minimal-versions.yml@master + with: + working-directory: ${{ github.workflow }} + + test: + runs-on: ubuntu-latest + strategy: + matrix: + rust: + - 1.87.0 # MSRV + - stable + steps: + - uses: actions/checkout@v5 + - uses: RustCrypto/actions/cargo-cache@master + - uses: dtolnay/rust-toolchain@master + with: + toolchain: ${{ matrix.rust }} + - run: cargo test + + # Test using `cargo careful` + test-careful: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + - uses: dtolnay/rust-toolchain@nightly + - run: cargo install cargo-careful + - run: cargo careful test --all-features diff --git a/Cargo.lock b/Cargo.lock index 861d5946..c1d90aa2 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -76,6 +76,13 @@ dependencies = [ "hybrid-array", ] +[[package]] +name = "ctutils" +version = "0.0.0" +dependencies = [ + "cmov", +] + [[package]] name = "dbl" version = "0.5.0" diff --git a/Cargo.toml b/Cargo.toml index d20ba5cc..12d085e6 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -6,6 +6,7 @@ members = [ "block-padding", "collectable", "cmov", + "ctutils", "cpufeatures", "dbl", "digest-io", @@ -20,3 +21,6 @@ exclude = ["aarch64-dit"] [profile.dev] opt-level = 2 + +[patch.crates-io] +cmov = { path = "cmov" } diff --git a/cmov/README.md b/cmov/README.md index d21ff09d..9c9d75cb 100644 --- a/cmov/README.md +++ b/cmov/README.md @@ -83,7 +83,7 @@ dual licensed as above, without any additional terms or conditions. [build-image]: https://github.com/RustCrypto/utils/actions/workflows/cmov.yml/badge.svg?branch=master [build-link]: https://github.com/RustCrypto/utils/actions/workflows/cmov.yml?query=branch:master -[//]: # (general links) +[//]: # (links) [RustCrypto]: https://github.com/RustCrypto [CMOV family]: https://www.jaist.ac.jp/iscenter-new/mpc/altix/altixdata/opt/intel/vtune/doc/users_guide/mergedProjects/analyzer_ec/mergedProjects/reference_olh/mergedProjects/instructions/instruct32_hh/vc35.htm diff --git a/ctutils/CHANGELOG.md b/ctutils/CHANGELOG.md new file mode 100644 index 00000000..d6637e04 --- /dev/null +++ b/ctutils/CHANGELOG.md @@ -0,0 +1,5 @@ +# Changelog +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). diff --git a/ctutils/Cargo.toml b/ctutils/Cargo.toml new file mode 100644 index 00000000..7acecf8b --- /dev/null +++ b/ctutils/Cargo.toml @@ -0,0 +1,20 @@ +[package] +name = "ctutils" +description = """ +Constant-time utility library with selection and equality testing support targeting cryptographic +applications. Supports `const fn` where appropriate. Built on the `cmov` crate which provides +architecture-specific predication intrinsics. Heavily inspired by the `subtle` crate. +""" +version = "0.0.0" +authors = ["RustCrypto Developers"] +license = "Apache-2.0 OR MIT" +homepage = "https://github.com/RustCrypto/utils/tree/master/ctselect" +repository = "https://github.com/RustCrypto/utils" +categories = ["cryptography", "no-std"] +keywords = ["crypto", "intrinsics"] +readme = "README.md" +edition = "2024" +rust-version = "1.87" + +[dependencies] +cmov = "0.4" diff --git a/ctutils/LICENSE-APACHE b/ctutils/LICENSE-APACHE new file mode 100644 index 00000000..d6456956 --- /dev/null +++ b/ctutils/LICENSE-APACHE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/ctutils/LICENSE-MIT b/ctutils/LICENSE-MIT new file mode 100644 index 00000000..82a58781 --- /dev/null +++ b/ctutils/LICENSE-MIT @@ -0,0 +1,25 @@ +Copyright (c) 2025 The RustCrypto Project Developers + +Permission is hereby granted, free of charge, to any +person obtaining a copy of this software and associated +documentation files (the "Software"), to deal in the +Software without restriction, including without +limitation the rights to use, copy, modify, merge, +publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software +is furnished to do so, subject to the following +conditions: + +The above copyright notice and this permission notice +shall be included in all copies or substantial portions +of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF +ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED +TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A +PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT +SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR +IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. diff --git a/ctutils/README.md b/ctutils/README.md new file mode 100644 index 00000000..ac088521 --- /dev/null +++ b/ctutils/README.md @@ -0,0 +1,67 @@ +# [RustCrypto]: Constant-Time Utilities + +[![Crate][crate-image]][crate-link] +[![Docs][docs-image]][docs-link] +[![Build Status][build-image]][build-link] +![Apache 2.0/MIT Licensed][license-image] +![MSRV][msrv-image] + +Constant-time utility library with selection and equality testing support targeting cryptographic +applications. Supports `const fn` where appropriate. Built on the [`cmov`] crate which provides +architecture-specific predication intrinsics. Heavily inspired by the `subtle` crate. + +## About + +This crate contains constant-time equivalents of the `bool` and `Option` types (`Choice` and +`CtOption`), along with traits that can be used in combination with them. + +The `CtOption` type notably provides eagerly evaluated combinator methods (as opposed to the lazily +evaluated combinators on `Option`) which make it possible to write constant-time code using +an idiomatic Rust style. + +This is an experimental next-generation constant-time library inspired by `subtle`, but for now we +recommend you continue to stick with `subtle`. We may attempt to get some of the changes in this +library incorporated into `subtle` for a potential v3.0. + +## ⚠️ Security Warning + +The implementation contained in this crate has never been independently audited! + +USE AT YOUR OWN RISK! + +## Minimum Supported Rust Version (MSRV) Policy + +MSRV increases are not considered breaking changes and can happen in patch releases. + +The crate MSRV accounts for all supported targets and crate feature combinations. + +## License + +Licensed under either of: + +* [Apache License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0) +* [MIT license](http://opensource.org/licenses/MIT) + +at your option. + +### Contribution + +Unless you explicitly state otherwise, any contribution intentionally submitted +for inclusion in the work by you, as defined in the Apache-2.0 license, shall be +dual licensed as above, without any additional terms or conditions. + +[//]: # (badges) + +[crate-image]: https://img.shields.io/crates/v/ctutils.svg +[crate-link]: https://crates.io/crates/ctutils +[docs-image]: https://docs.rs/ctutils/badge.svg +[docs-link]: https://docs.rs/ctutils/ +[license-image]: https://img.shields.io/badge/license-Apache2.0/MIT-blue.svg +[msrv-image]: https://img.shields.io/badge/rustc-1.87+-blue.svg +[build-image]: https://github.com/RustCrypto/utils/actions/workflows/ctutils.yml/badge.svg?branch=master +[build-link]: https://github.com/RustCrypto/utils/actions/workflows/ctutils.yml?query=branch:master + +[//]: # (links) + +[RustCrypto]: https://github.com/RustCrypto +[`cmov`]: https://docs.rs/cmov diff --git a/ctutils/src/choice.rs b/ctutils/src/choice.rs new file mode 100644 index 00000000..9288b474 --- /dev/null +++ b/ctutils/src/choice.rs @@ -0,0 +1,238 @@ +use crate::{CtEq, CtSelect}; +use core::ops::{BitAnd, BitAndAssign, BitOr, BitOrAssign, BitXor, BitXorAssign, Not}; + +/// Constant-time analogue of `bool` providing a "best effort" optimization barrier. +/// +/// Attempts to hint to the compiler and its codegen backends that optimizations should not be +/// applied which depend on a value. +/// +/// This is used as a "belt-and-suspenders" defense in addition to mechanisms like +/// constant-time predication intrinsics provided by the `cmov` crate, and is never expected to be +/// the only line of defense. +#[derive(Copy, Clone, Debug)] +pub struct Choice(u8); + +impl Choice { + /// The falsy value. + pub const FALSE: Self = Self(0); + + /// The truthy value. + pub const TRUE: Self = Self(1); + + /// Create a new [`Choice`] from the given `u8` value, which should be either `0` or `1`. + #[inline] + pub const fn new(value: u8) -> Self { + // Compare to what should be the non-secret upper bits of the value, which should always be + // zero, and thus avoid branching on the bit that carries a potential secret + debug_assert!(value & 0xFE == 0, "Choice::new accepts only 0 or 1"); + Self(value) + } + + /// Convert `Choice` into a `bool`. + /// + ///
+ /// Security Warning + /// + /// Using this function will introduce timing variability, since computing this at all currently + /// requires a branch. + /// + /// This is intended to be used as either the one and only branch at the end of a constant-time + /// operation to e.g. differentiate between success and failure, or in contexts where + /// constant-time doesn't matter, e.g. variable-time code that operates on "maybe secret" types + /// which aren't secrets in a particular context. + /// + /// If you are trying to use this in the context of a constant-time operation, be warned that + /// the small amount of timing variability it introduces can potentially be exploited. Whenever + /// possible, prefer fully constant-time approaches instead. + ///
+ pub const fn to_bool(self) -> bool { + self.to_u8() != 0 + } + + /// Convert [`Choice`] to a `u8`, attempting to apply a "best effort" optimization barrier. + pub const fn to_u8(self) -> u8 { + // `black_box` is documented as working on a "best effort" basis. That's fine, this type is + // likewise documented as only working on a "best effort" basis itself. The only way we + // rely on `black_box` for correctness is it behaving as the identity function. + core::hint::black_box(self.0) + } + + /// Apply an `and` conditional to the given [`Choice`]s. + #[inline] + pub const fn and(self, rhs: Choice) -> Choice { + Self(self.0 & rhs.0) + } + + /// Apply an `or` conditional to the given [`Choice`]s. + #[inline] + pub const fn or(self, rhs: Choice) -> Choice { + Self(self.0 | rhs.0) + } + + /// Apply an `xor` conditional to the given [`Choice`]s. + #[inline] + pub const fn xor(self, rhs: Choice) -> Choice { + Self(self.0 ^ rhs.0) + } + + /// Compute the boolean inverse of `self`. + #[inline] + pub const fn not(self) -> Choice { + // NOTE: assumes self.0 is `0` or `1` as checked in constructor + Self(self.0 ^ 1) + } +} + +impl BitAnd for Choice { + type Output = Choice; + + #[inline] + fn bitand(self, rhs: Choice) -> Choice { + self.and(rhs) + } +} + +impl BitAndAssign for Choice { + #[inline] + fn bitand_assign(&mut self, rhs: Choice) { + *self = *self & rhs; + } +} + +impl BitOr for Choice { + type Output = Choice; + + #[inline] + fn bitor(self, rhs: Choice) -> Choice { + self.or(rhs) + } +} + +impl BitOrAssign for Choice { + #[inline] + fn bitor_assign(&mut self, rhs: Choice) { + *self = *self | rhs; + } +} + +impl BitXor for Choice { + type Output = Choice; + + #[inline] + fn bitxor(self, rhs: Choice) -> Choice { + Choice(self.0 ^ rhs.0) + } +} + +impl BitXorAssign for Choice { + #[inline] + fn bitxor_assign(&mut self, rhs: Choice) { + *self = *self ^ rhs; + } +} + +impl CtEq for Choice { + #[inline] + fn ct_eq(&self, other: &Self) -> Self { + self.0.ct_eq(&other.0) + } +} + +impl CtSelect for Choice { + #[inline] + fn ct_select(&self, other: &Self, choice: Choice) -> Self { + Choice(self.0.ct_select(&other.0, choice)) + } +} + +impl From for u8 { + fn from(choice: Choice) -> u8 { + choice.to_u8() + } +} + +impl From for bool { + fn from(choice: Choice) -> bool { + choice.to_bool() + } +} + +impl Not for Choice { + type Output = Choice; + + #[inline] + fn not(self) -> Choice { + self.not() + } +} + +#[cfg(test)] +mod tests { + use super::Choice; + use crate::{CtEq, CtSelect}; + + #[test] + fn ct_eq() { + let a = Choice::TRUE; + let b = Choice::TRUE; + let c = Choice::FALSE; + + assert!(a.ct_eq(&b).to_bool()); + assert!(!a.ct_eq(&c).to_bool()); + assert!(!b.ct_eq(&c).to_bool()); + + assert!(!a.ct_ne(&b).to_bool()); + assert!(a.ct_ne(&c).to_bool()); + assert!(b.ct_ne(&c).to_bool()); + } + + #[test] + fn ct_select() { + let a = Choice::FALSE; + let b = Choice::TRUE; + assert_eq!(a.ct_select(&b, Choice::FALSE).to_bool(), a.to_bool()); + assert_eq!(a.ct_select(&b, Choice::TRUE).to_bool(), b.to_bool()); + } + + #[test] + fn to_bool() { + assert_eq!(Choice::new(0).to_bool(), false); + assert_eq!(Choice::new(1).to_bool(), true); + } + + #[test] + fn to_u8() { + assert_eq!(Choice::new(0).to_u8(), 0); + assert_eq!(Choice::new(1).to_u8(), 1); + } + + #[test] + fn and() { + assert_eq!((Choice::new(0) & Choice::new(0)).to_u8(), 0); + assert_eq!((Choice::new(1) & Choice::new(0)).to_u8(), 0); + assert_eq!((Choice::new(0) & Choice::new(1)).to_u8(), 0); + assert_eq!((Choice::new(1) & Choice::new(1)).to_u8(), 1); + } + + #[test] + fn or() { + assert_eq!((Choice::new(0) | Choice::new(0)).to_u8(), 0); + assert_eq!((Choice::new(1) | Choice::new(0)).to_u8(), 1); + assert_eq!((Choice::new(0) | Choice::new(1)).to_u8(), 1); + assert_eq!((Choice::new(1) | Choice::new(1)).to_u8(), 1); + } + + #[test] + fn xor() { + assert_eq!((Choice::new(0) ^ Choice::new(0)).to_u8(), 0); + assert_eq!((Choice::new(1) ^ Choice::new(0)).to_u8(), 1); + assert_eq!((Choice::new(0) ^ Choice::new(1)).to_u8(), 1); + assert_eq!((Choice::new(1) ^ Choice::new(1)).to_u8(), 0); + } + + #[test] + fn not() { + assert_eq!(Choice::new(0).not().to_u8(), 1); + assert_eq!(Choice::new(1).not().to_u8(), 0); + } +} diff --git a/ctutils/src/ct_option.rs b/ctutils/src/ct_option.rs new file mode 100644 index 00000000..c2c53a53 --- /dev/null +++ b/ctutils/src/ct_option.rs @@ -0,0 +1,574 @@ +use crate::{Choice, CtEq, CtSelect}; +use core::ops::{Deref, DerefMut}; + +/// Equivalent of [`Option`] but predicated on a [`Choice`] with combinators that allow for +/// constant-time operations which always perform the same sequence of instructions regardless of +/// the value of `is_some`. +/// +/// Unlike [`Option`], [`CtOption`] always contains a value, and will use the contained value when +/// e.g. evaluating the callbacks of combinator methods, which unlike `core` it does unconditionally +/// in order to ensure constant-time operation. This approach stands in contrast to the lazy +/// evaluation similar methods on [`Option`] provide. +#[derive(Clone, Copy, Debug)] +pub struct CtOption { + value: T, + is_some: Choice, +} + +impl CtOption { + /// Construct a new [`CtOption`], with a [`Choice`] parameter `is_some` as a stand-in for + /// `Some` or `None` enum variants of a typical [`Option`] type. + #[inline] + pub const fn new(value: T, is_some: Choice) -> CtOption { + Self { value, is_some } + } + + /// Convert from a `&mut CtOption` to `CtOption<&mut T>`. + #[inline] + pub const fn as_mut(&mut self) -> CtOption<&mut T> { + CtOption { + value: &mut self.value, + is_some: self.is_some, + } + } + + /// Convert from a `&CtOption` to `CtOption<&T>`. + #[inline] + pub const fn as_ref(&self) -> CtOption<&T> { + CtOption { + value: &self.value, + is_some: self.is_some, + } + } + + /// Convert from `CtOption` (or `&CtOption`) to `CtOption<&T::Target>`, for types which + /// impl the [`Deref`] trait. + pub fn as_deref(&self) -> CtOption<&T::Target> + where + T: Deref, + { + self.as_ref().map(Deref::deref) + } + + /// Convert from `CtOption` (or `&mut CtOption`) to `CtOption<&mut T::Target>`, for types + /// which impl the [`DerefMut`] trait. + pub fn as_deref_mut(&mut self) -> CtOption<&mut T::Target> + where + T: DerefMut, + { + self.as_mut().map(DerefMut::deref_mut) + } + + /// Return the contained value, consuming the `self` value. + /// + /// # Panics + /// + /// In the event `self.is_some()` is [`Choice::FALSE`], panics with a custom panic message + /// provided as the `msg` argument. + #[inline] + pub fn expect(self, msg: &str) -> T { + assert!(self.is_some().to_bool(), "{}", msg); + self.value + } + + /// Convert the [`CtOption`] wrapper into an [`Option`], depending on whether + /// [`CtOption::is_some`] is a truthy or falsy [`Choice`]. + /// + /// This function exists to avoid ending up with ugly, verbose and/or bad handled conversions + /// from the [`CtOption`] wraps to an [`Option`] or [`Result`]. + /// + /// It's equivalent to the corresponding [`From`] impl, however this version is friendlier for + /// type inference. + /// + ///
+ /// This implementation doesn't intend to be constant-time nor try to protect the leakage of the + /// `T` value since the [`Option`] will do it anyway. + ///
+ #[inline] + pub fn into_option(self) -> Option { + if self.is_some.to_bool() { + Some(self.value) + } else { + None + } + } + + /// Returns [`Choice::TRUE`] if the option is the equivalent of a `Some`. + #[inline] + #[must_use] + pub const fn is_some(&self) -> Choice { + self.is_some + } + + /// Returns [`Choice::TRUE`] if the option is the equivalent of a `None`. + #[inline] + #[must_use] + pub const fn is_none(&self) -> Choice { + self.is_some.not() + } + + /// Returns `optb` if `self.is_some()` is [`Choice::TRUE`], otherwise returns a [`CtOption`] + /// where `self.is_some()` is [`Choice::FALSE`]. + #[inline] + pub fn and(self, mut optb: CtOption) -> CtOption { + optb.is_some &= self.is_some; + optb + } + + /// Calls the provided callback with the wrapped inner value, returning the resulting + /// [`CtOption`] value in the event that `self.is_some()` is [`Choice::TRUE`], or if not + /// returns a [`CtOption`] with `self.is_none()`. + /// + /// Unlike [`Option`], the provided callback `f` is unconditionally evaluated to ensure + /// constant-time operation. This requires evaluating the function with "dummy" value of `T` + /// (e.g. if the [`CtOption`] was constructed with a supplied placeholder value and + /// [`Choice::FALSE`], the placeholder value will be provided). + #[inline] + pub fn and_then(self, f: F) -> CtOption + where + F: FnOnce(T) -> CtOption, + { + let mut ret = f(self.value); + ret.is_some &= self.is_some; + ret + } + + /// Calls the provided callback with the wrapped inner value, which computes a [`Choice`], + /// and updates `self.is_some()`. + /// + /// It updates it to be [`Choice::FALSE`] in the event the returned choice is also false. + /// If it was [`Choice::FALSE`] to begin with, it will unconditionally remain that way. + #[inline] + pub fn filter

(mut self, predicate: P) -> Self + where + P: FnOnce(&T) -> Choice, + { + self.is_some &= predicate(&self.value); + self + } + + /// Maps a `CtOption` to a `CtOption` by unconditionally applying a function to the + /// contained `value`, but returning a new option value which inherits `self.is_some()`. + #[inline] + pub fn map(self, f: F) -> CtOption + where + F: FnOnce(T) -> U, + { + CtOption::new(f(self.value), self.is_some) + } + + /// Maps a `CtOption` to a `U` value, eagerly evaluating the provided function, and returning + /// the supplied `default` in the event `self.is_some()` is [`Choice::FALSE`]. + #[inline] + #[must_use = "if you don't need the returned value, use `if let` instead"] + pub fn map_or(self, default: U, f: F) -> U + where + U: CtSelect, + F: FnOnce(T) -> U, + { + self.map(f).unwrap_or(default) + } + + /// Maps a `CtOption` to a `U` value, eagerly evaluating the provided function, precomputing + /// `U::default()` using the [`Default`] trait, and returning it in the event `self.is_some()` + /// is [`Choice::FALSE`]. + #[inline] + pub fn map_or_default(self, f: F) -> U + where + U: CtSelect + Default, + F: FnOnce(T) -> U, + { + self.map_or(U::default(), f) + } + + /// Transforms a `CtOption` into a `Result`, mapping to `Ok(T)` if `self.is_some()` is + /// [`Choice::TRUE`], or mapping to the provided `err` in the event `self.is_some()` is + /// [`Choice::FALSE`]. + /// + ///

+ /// This implementation doesn't intend to be constant-time nor try to protect the leakage of the + /// `T` value since the [`Option`] will do it anyway. + ///
+ #[inline] + pub fn ok_or(self, err: E) -> Result { + self.into_option().ok_or(err) + } + + /// Transforms a `CtOption` into a `Result` by unconditionally calling the provided + /// callback value and using its result in the event `self.is_some()` is [`Choice::FALSE`]. + #[inline] + pub fn ok_or_else(self, err: F) -> Result + where + F: FnOnce() -> E, + { + self.ok_or(err()) + } + + /// Returns `self` if `self.is_some()` is [`Choice::TRUE`], otherwise returns `optb`. + #[inline] + pub fn or(self, optb: CtOption) -> CtOption + where + T: CtSelect, + { + CtOption { + value: self.value.ct_select(&optb.value, self.is_none()), + is_some: self.is_some | optb.is_some, + } + } + + /// Return the contained value, consuming the `self` value. + /// + /// Use of this function is discouraged due to panic potential. Instead, prefer non-panicking + /// alternatives such as `unwrap_or` or `unwrap_or_default` which operate in constant-time. + /// + /// As the final step of a sequence of constant-time operations, or in the event you are dealing + /// with a [`CtOption`] in a non-secret context where constant-time does not matter, you can + /// also convert to [`Option`] using `into_option` or the [`From`] impl on [`Option`]. Note + /// this introduces a branch and with it a small amount of timing variability. If possible try + /// to avoid this branch when writing constant-time code (e.g. use implicit rejection instead + /// of `Option`/`Result` to handle errors) + /// + /// # Panics + /// + /// In the event `self.is_some()` is [`Choice::FALSE`]. + #[inline] + pub fn unwrap(self) -> T { + assert!( + self.is_some.to_bool(), + "called `CtOption::unwrap()` on a value with `is_some` set to `Choice::FALSE`" + ); + self.value + } + + /// Return the contained value in the event `self.is_some()` is [`Choice::TRUE`], or if not, + /// uses a provided default. + #[inline] + pub fn unwrap_or(self, default: T) -> T + where + T: CtSelect, + { + default.ct_select(&self.value, self.is_some) + } + + /// Unconditionally computes `T::default()` using the [`Default`] trait, then returns either + /// the contained value if `self.is_some()` is [`Choice::TRUE`], or if it's [`Choice::FALSE`] + /// returns the previously computed default. + #[inline] + pub fn unwrap_or_default(self) -> T + where + T: CtSelect + Default, + { + self.unwrap_or(T::default()) + } + + /// Returns an "is some" [`CtOption`] with the contained value from either `self` or `optb` in + /// the event exactly one of them has `self.is_some()` set to [`Choice::TRUE`], or else returns + /// a [`CtOption`] with `self.is_some()` set to [`Choice::FALSE`]. + #[inline] + pub fn xor(self, optb: CtOption) -> CtOption + where + T: CtSelect, + { + CtOption { + value: self.value.ct_select(&optb.value, self.is_none()), + is_some: self.is_some ^ optb.is_some, + } + } + + /// Zips `self` with another [`CtOption`]. + /// + /// If `self.is_some() && other.is_some()`, this method returns a new [`CtOption`] for a 2-tuple + /// of their contents where `is_some()` is [`Choice::TRUE`]. + /// + /// Otherwise, a [`CtOption`] where `is_some()` is [`Choice::FALSE`] is returned. + pub fn zip(self, other: CtOption) -> CtOption<(T, U)> { + CtOption { + value: (self.value, other.value), + is_some: self.is_some & other.is_some, + } + } + + /// Zips `self` and another `CtOption` with function `f`. + /// + /// If `self.is_some() && other.is_some()`, this method returns a new [`CtOption`] for + /// the result of `f` applied to their inner values where `is_some()` is [`Choice::TRUE`]. + /// + /// Otherwise, a [`CtOption`] where `is_some()` is [`Choice::FALSE`] is returned. + pub fn zip_with(self, other: CtOption, f: F) -> CtOption + where + F: FnOnce(T, U) -> R, + { + self.zip(other).map(|(a, b)| f(a, b)) + } +} + +impl CtOption<&T> { + /// Maps a `CtOption<&T>` to `CtOption` by copying the contents of the option. + #[must_use = "`self` will be dropped if the result is not used"] + pub const fn copied(self) -> CtOption + where + T: Copy, + { + CtOption { + value: *self.value, + is_some: self.is_some, + } + } + + /// Maps a `CtOption<&T>` to `CtOption` by cloning the contents of the option. + #[must_use = "`self` will be dropped if the result is not used"] + pub fn cloned(self) -> CtOption + where + T: Clone, + { + CtOption { + value: self.value.clone(), + is_some: self.is_some, + } + } +} + +impl CtOption<&mut T> { + /// Maps a `CtOption<&mut T>` to `CtOption` by copying the contents of the option. + #[must_use = "`self` will be dropped if the result is not used"] + pub const fn copied(self) -> CtOption + where + T: Copy, + { + CtOption { + value: *self.value, + is_some: self.is_some, + } + } + + /// Maps a `CtOption<&mut T>` to `CtOption` by cloning the contents of the option. + #[must_use = "`self` will be dropped if the result is not used"] + pub fn cloned(self) -> CtOption + where + T: Clone, + { + CtOption { + value: self.value.clone(), + is_some: self.is_some, + } + } +} + +impl CtEq for CtOption { + #[inline] + fn ct_eq(&self, other: &CtOption) -> Choice { + (self.is_some & other.is_some & self.value.ct_eq(&other.value)) + | (self.is_none() & other.is_none()) + } +} + +impl CtSelect for CtOption { + fn ct_select(&self, other: &Self, choice: Choice) -> Self { + let value = self.value.ct_select(&other.value, choice); + let is_some = self.is_some.ct_select(&other.is_some, choice); + CtOption::new(value, is_some) + } +} + +/// Convert the [`CtOption`] wrapper into an [`Option`], depending on whether +/// [`CtOption::is_some`] is a truthy or falsy [`Choice`]. +/// +///
+/// +/// This implementation doesn't intend to be constant-time nor try to protect the leakage of the +/// `T` value since the `Option` will do it anyway. +/// +///
+impl From> for Option { + fn from(src: CtOption) -> Option { + src.into_option() + } +} + +#[cfg(test)] +mod tests { + use crate::{Choice, CtEq, CtOption, CtSelect}; + + /// Example wrapped value for testing + const VALUE: u8 = 42; + + /// Example option which is like `Option::Some` + const SOME: CtOption = CtOption::new(VALUE, Choice::TRUE); + + /// Example option which is like `Option::None` + const NONE: CtOption = CtOption::new(VALUE, Choice::FALSE); + + /// Another option containing a different value + const OTHER: CtOption = CtOption::new(VALUE + 1, Choice::TRUE); + + /// Dummy error type + #[derive(Debug, Eq, PartialEq)] + struct Error; + + #[test] + fn ct_eq() { + assert!(NONE.ct_eq(&NONE).to_bool()); + assert!(NONE.ct_ne(&SOME).to_bool()); + assert!(SOME.ct_ne(&NONE).to_bool()); + assert!(SOME.ct_eq(&SOME).to_bool()); + assert!(SOME.ct_ne(&OTHER).to_bool()); + } + + #[test] + fn ct_select() { + assert!(NONE.ct_select(&SOME, Choice::FALSE).is_none().to_bool()); + assert!(NONE.ct_select(&SOME, Choice::TRUE).ct_eq(&SOME).to_bool()); + assert!(SOME.ct_select(&NONE, Choice::FALSE).ct_eq(&SOME).to_bool()); + assert!(SOME.ct_select(&NONE, Choice::TRUE).is_none().to_bool()); + } + + #[test] + fn expect_some() { + assert_eq!(SOME.expect("should succeed"), VALUE); + } + + #[test] + #[should_panic] + fn expect_none() { + NONE.expect("should panic"); + } + + #[test] + fn into_option() { + assert_eq!(SOME.into_option(), Some(VALUE)); + assert_eq!(NONE.into_option(), None) + } + + #[test] + fn is_some() { + assert!(SOME.is_some().to_bool()); + assert!(!NONE.is_some().to_bool()); + } + + #[test] + fn is_none() { + assert!(!SOME.is_none().to_bool()); + assert!(NONE.is_none().to_bool()); + } + + #[test] + fn and() { + assert!(SOME.and(NONE).is_none().to_bool()); + assert_eq!(SOME.and(OTHER).unwrap(), OTHER.unwrap()); + } + + #[test] + fn and_then() { + assert!(NONE.and_then(|_| NONE).is_none().to_bool()); + assert!(NONE.and_then(|_| SOME).is_none().to_bool()); + + let ret = SOME.and_then(|value| { + assert_eq!(VALUE, value); + OTHER + }); + assert!(ret.ct_eq(&OTHER).to_bool()); + } + + #[test] + fn filter() { + assert!(NONE.filter(|_| Choice::TRUE).ct_eq(&NONE).to_bool()); + assert!(NONE.filter(|_| Choice::FALSE).ct_eq(&NONE).to_bool()); + assert!(SOME.filter(|_| Choice::FALSE).ct_eq(&NONE).to_bool()); + + let ret = SOME.filter(|&value| { + assert_eq!(VALUE, value); + Choice::TRUE + }); + assert_eq!(ret.unwrap(), VALUE); + } + + #[test] + fn map() { + assert!(NONE.map(|value| value + 1).ct_eq(&NONE).to_bool()); + assert!(SOME.map(|value| value + 1).ct_eq(&OTHER).to_bool()); + } + + #[test] + fn map_or() { + let example = 52; + assert_eq!(NONE.map_or(example, |value| value + 1), example); + assert_eq!(SOME.map_or(example, |value| value + 1), VALUE + 1); + } + + #[test] + fn map_or_default() { + assert_eq!(NONE.map_or_default(|value| value + 1), Default::default()); + assert_eq!(SOME.map_or_default(|value| value + 1), VALUE + 1); + } + + #[test] + fn ok_or() { + assert_eq!(NONE.ok_or(Error), Err(Error)); + assert_eq!(SOME.ok_or(Error), Ok(VALUE)); + } + + #[test] + fn ok_or_else() { + assert_eq!(NONE.ok_or_else(|| Error), Err(Error)); + assert_eq!(SOME.ok_or_else(|| Error), Ok(VALUE)); + } + + #[test] + fn or() { + assert!(NONE.or(NONE).is_none().to_bool()); + assert!(SOME.or(NONE).ct_eq(&SOME).to_bool()); + assert!(NONE.or(SOME).ct_eq(&SOME).to_bool()); + assert!(SOME.or(OTHER).ct_eq(&SOME).to_bool()); + } + + #[test] + fn unwrap_some() { + assert_eq!(SOME.unwrap(), VALUE); + } + + #[test] + #[should_panic] + fn unwrap_none() { + NONE.unwrap(); + } + + #[test] + fn unwrap_or() { + let example = 52; + assert_eq!(NONE.unwrap_or(example), example); + assert_eq!(SOME.unwrap_or(example), VALUE); + } + + #[test] + fn unwrap_or_default() { + assert_eq!(NONE.unwrap_or_default(), Default::default()); + assert_eq!(SOME.unwrap_or_default(), VALUE); + } + + #[test] + fn xor() { + assert!(NONE.xor(NONE).is_none().to_bool()); + assert!(SOME.xor(NONE).ct_eq(&SOME).to_bool()); + assert!(NONE.xor(SOME).ct_eq(&SOME).to_bool()); + assert!(SOME.xor(OTHER).is_none().to_bool()); + } + + #[test] + fn zip() { + assert!(NONE.zip(NONE).is_none().to_bool()); + assert!(NONE.zip(SOME).is_none().to_bool()); + assert!(SOME.zip(NONE).is_none().to_bool()); + assert_eq!(SOME.zip(OTHER).unwrap(), (SOME.unwrap(), OTHER.unwrap())); + } + + #[test] + fn zip_with() { + assert!(NONE.zip_with(NONE, |a, b| a + b).is_none().to_bool()); + assert!(NONE.zip_with(SOME, |a, b| a + b).is_none().to_bool()); + assert!(SOME.zip_with(NONE, |a, b| a + b).is_none().to_bool()); + assert_eq!( + SOME.zip_with(OTHER, |a, b| a + b).unwrap(), + SOME.unwrap() + OTHER.unwrap() + ); + } +} diff --git a/ctutils/src/lib.rs b/ctutils/src/lib.rs new file mode 100644 index 00000000..bec55469 --- /dev/null +++ b/ctutils/src/lib.rs @@ -0,0 +1,73 @@ +#![no_std] +#![doc = include_str!("../README.md")] +#![doc( + html_logo_url = "https://raw.githubusercontent.com/RustCrypto/meta/master/logo.svg", + html_favicon_url = "https://raw.githubusercontent.com/RustCrypto/meta/master/logo.svg" +)] +#![deny(unsafe_code)] +#![warn( + clippy::mod_module_files, + missing_docs, + missing_debug_implementations, + missing_copy_implementations, + rust_2018_idioms, + trivial_casts, + trivial_numeric_casts, + unused_qualifications +)] +#![cfg_attr(not(test), warn(clippy::unwrap_used))] + +//! # API Design +//! +//! ## [`Choice`]: constant-time analogue for [`bool`] +//! Values of this type are one of either [`Choice::FALSE`] or [`Choice::TRUE`]. +//! +//! To achieve constant-time operation, `Choice` is ultimately used in combination with special +//! CPU-specific constant-time predication instructions implemented by the [`cmov`] crate +//! (with a portable "best effort" fallback that cannot provide guarantees). +//! +//! It additionally uses various methods to hint to the compiler that it should avoid inserting +//! branches based on its value where it otherwise would if `bool` were used instead, but cannot +//! provide guarantees in this regard. +//! +//! ## [`CtOption`]: constant-time analogue for [`Option`] +//! The core `Option` type is typically great for representing the conditional absence or presence +//! of a value, and provides a number of handy combinators for operating on them. +//! +//! However, it has a rather fundamental flaw when constant-time is desirable: its combinators are +//! lazily evaluated. To ensure constant-time operation, all combinators must be eagerly evaluated +//! so they aren't conditionally executed based on the value's presence. +//! +//! `CtOption` instead carries a `Choice` along with a value, which makes it possible to do +//! something it isn't with `Option`: evaluate combinators eagerly instead of lazily, running the +//! same functions regardless of the value's effective presence or absence. +//! +//! ## [`CtEq`]: constant-time analogue for [`PartialEq`]/[`Eq`] +//! Equality testing often short circuits for performance reasons, but when comparing values in +//! constant-time such short-circuiting is forbidden. +//! +//! The `CtEq` trait is a replacement for these scenarios. It's impl'd for several core types +//! including unsigned and signed integers as well as slices and arrays. It returns a `Choice` +//! as opposed to a `bool`], following the standard practice in this crate. +//! +//! *NOTE: for `subtle` users, this is the equivalent of the `ConstantTimeEq` trait* +//! +//! ## [`CtSelect`]: constant-time [predication] +//! Predication in computer architecture describes methods for conditionally modifying state +//! using non-branch instructions which perform conditional modifications based on a *predicate* +//! or boolean value, in the design of this library a `Choice`. +//! +//! The `CtSelect` trait provides methods for performing conditional moves, either conditionally +//! modifying a value in-place, or selecting from two different inputs and returning a new one. +//! +//! *NOTE: for `subtle` users, this is the equivalent of the `ConditionallySelectable` trait* +//! +//! [predication]: https://en.wikipedia.org/wiki/Predication_(computer_architecture) + +mod choice; +mod ct_option; +mod traits; + +pub use choice::Choice; +pub use ct_option::CtOption; +pub use traits::{ct_eq::CtEq, ct_select::CtSelect}; diff --git a/ctutils/src/traits.rs b/ctutils/src/traits.rs new file mode 100644 index 00000000..a9f87aae --- /dev/null +++ b/ctutils/src/traits.rs @@ -0,0 +1,7 @@ +//! Trait definitions. +//! +//! These are each in their own module so we can also define tests for the core types they're impl'd +//! on in the same module. + +pub(crate) mod ct_eq; +pub(crate) mod ct_select; diff --git a/ctutils/src/traits/ct_eq.rs b/ctutils/src/traits/ct_eq.rs new file mode 100644 index 00000000..47db87f2 --- /dev/null +++ b/ctutils/src/traits/ct_eq.rs @@ -0,0 +1,158 @@ +use crate::Choice; +use cmov::CmovEq; +use core::cmp; + +/// Constant-time equality: like `(Partial)Eq` with [`Choice`] instead of [`bool`]. +/// +/// Impl'd for: [`u8`], [`u16`], [`u32`], [`u64`], [`u128`], [`usize`], [`cmp::Ordering`], +/// [`Choice`], and arrays/slices of any type which also impls [`CtEq`]. +pub trait CtEq +where + Rhs: ?Sized, +{ + /// Equality + fn ct_eq(&self, other: &Rhs) -> Choice; + + /// Inequality + fn ct_ne(&self, other: &Rhs) -> Choice { + !self.ct_eq(other) + } +} + +// Impl `CtEq` using the `cmov::CmovEq` trait +macro_rules! impl_unsigned_ct_eq_with_cmov { + ( $($uint:ty),+ ) => { + $( + impl CtEq for $uint { + #[inline] + fn ct_eq(&self, other: &Self) -> Choice { + let mut ret = 0; + self.cmoveq(other, 1, &mut ret); + Choice::new(ret) + } + } + )+ + }; +} + +// Impl `CtEq` by first casting to unsigned then using the unsigned `CtEq` impls +// TODO(tarcieri): add signed integer support to `cmov` +macro_rules! impl_signed_ct_eq_with_cmov { + ( $($int:ty),+ ) => { + $( + impl CtEq for $int { + #[inline] + fn ct_eq(&self, other: &Self) -> Choice { + self.cast_unsigned().ct_eq(&other.cast_unsigned()) + } + } + )+ + }; +} + +impl_unsigned_ct_eq_with_cmov!(u8, u16, u32, u64, u128); +impl_signed_ct_eq_with_cmov!(i8, i16, i32, i64, i128); + +#[cfg(any(target_pointer_width = "32", target_pointer_width = "64"))] +impl CtEq for usize { + #[cfg(target_pointer_width = "32")] + fn ct_eq(&self, other: &Self) -> Choice { + (*self as u32).ct_eq(&(*other as u32)) + } + + #[cfg(target_pointer_width = "64")] + fn ct_eq(&self, other: &Self) -> Choice { + (*self as u64).ct_eq(&(*other as u64)) + } +} + +impl CtEq for cmp::Ordering { + #[inline] + fn ct_eq(&self, other: &Self) -> Choice { + // `Ordering` is `repr(i8)`, which has a `CtEq` impl + (*self as i8).ct_eq(&(*other as i8)) + } +} + +impl CtEq for [T] { + #[inline] + fn ct_eq(&self, other: &[T]) -> Choice { + let mut ret = self.len().ct_eq(&other.len()); + for (a, b) in self.iter().zip(other.iter()) { + ret &= a.ct_eq(b); + } + ret + } +} + +impl CtEq for [T; N] { + #[inline] + fn ct_eq(&self, other: &[T; N]) -> Choice { + self.as_slice().ct_eq(other.as_slice()) + } +} + +#[cfg(test)] +mod tests { + use super::CtEq; + use core::cmp::Ordering; + + macro_rules! truth_table { + ($a:expr, $b:expr, $c:expr) => { + assert!($a.ct_eq(&$b).to_bool()); + assert!(!$a.ct_eq(&$c).to_bool()); + assert!(!$b.ct_eq(&$c).to_bool()); + + assert!(!$a.ct_ne(&$b).to_bool()); + assert!($a.ct_ne(&$c).to_bool()); + assert!($b.ct_ne(&$c).to_bool()); + }; + } + + macro_rules! ct_eq_test { + ($ty:ty, $name:ident) => { + #[test] + fn $name() { + let a: $ty = 42; + let b: $ty = 42; + let c: $ty = 1; + truth_table!(a, b, c); + } + }; + } + + ct_eq_test!(u8, u8_ct_eq); + ct_eq_test!(u16, u16_ct_eq); + ct_eq_test!(u32, u32_ct_eq); + ct_eq_test!(u64, u64_ct_eq); + ct_eq_test!(u128, u128_ct_eq); + ct_eq_test!(usize, usize_ct_eq); + + #[test] + fn array_ct_eq() { + let a = [1u64, 2, 3]; + let b = [1u64, 2, 3]; + let c = [1u64, 2, 4]; + truth_table!(a, b, c); + } + + #[test] + fn ordering_ct_eq() { + let a = Ordering::Greater; + let b = Ordering::Greater; + let c = Ordering::Less; + truth_table!(a, b, c); + } + + #[test] + fn slice_ct_eq() { + let a: &[u64] = &[1, 2, 3]; + let b: &[u64] = &[1, 2, 3]; + let c: &[u64] = &[1, 2, 4]; + truth_table!(a, b, c); + + // Length mismatches + assert!(a.ct_ne(&[]).to_bool()); + assert!(a.ct_ne(&[1, 2]).to_bool()); + } +} diff --git a/ctutils/src/traits/ct_select.rs b/ctutils/src/traits/ct_select.rs new file mode 100644 index 00000000..287fc6e1 --- /dev/null +++ b/ctutils/src/traits/ct_select.rs @@ -0,0 +1,146 @@ +use crate::Choice; +use cmov::Cmov; +use core::cmp; + +/// Constant-time selection: pick between two values based on a given [`Choice`]. +pub trait CtSelect: Sized { + /// Select between `self` and `other` based on `choice`, returning a copy of the value. + /// + /// # Returns + /// - `self` if `choice` is [`Choice::FALSE`]. + /// - `other` if `choice` is [`Choice::TRUE`]. + fn ct_select(&self, other: &Self, choice: Choice) -> Self; + + /// Conditionally assign `other` to `self` if `choice` is [`Choice::TRUE`]. + fn ct_assign(&mut self, other: &Self, choice: Choice) { + *self = Self::ct_select(self, other, choice); + } + + /// Conditionally swap `self` and `other` if `choice` is [`Choice::TRUE`]. + fn ct_swap(&mut self, other: &mut Self, choice: Choice) { + let tmp = self.ct_select(other, choice); + *other = Self::ct_select(other, self, choice); + *self = tmp; + } +} + +// Impl `CtSelect` using the `cmov::Cmov` trait +macro_rules! impl_unsigned_ct_select_with_cmov { + ( $($uint:ty),+ ) => { + $( + impl CtSelect for $uint { + #[inline] + fn ct_select(&self, other: &Self, choice: Choice) -> Self { + let mut ret = *self; + ret.ct_assign(other, choice); + ret + } + + fn ct_assign(&mut self, other: &Self, choice: Choice) { + self.cmovnz(other, choice.into()); + } + } + )+ + }; +} + +// Impl `CtSelect` by first casting to unsigned then using the unsigned `CtSelect` impls +// TODO(tarcieri): add signed integer support to `cmov` +macro_rules! impl_signed_ct_select_with_cmov { + ( $($int:ty),+ ) => { + $( + impl CtSelect for $int { + #[inline] + fn ct_select(&self, other: &Self, choice: Choice) -> Self { + self.cast_unsigned().ct_select(&other.cast_unsigned(), choice).cast_signed() + } + } + )+ + }; +} + +impl_unsigned_ct_select_with_cmov!(u8, u16, u32, u64, u128); +impl_signed_ct_select_with_cmov!(i8, i16, i32, i64, i128); + +#[cfg(any(target_pointer_width = "32", target_pointer_width = "64"))] +impl CtSelect for usize { + #[cfg(target_pointer_width = "32")] + #[inline] + fn ct_select(&self, other: &Self, choice: Choice) -> Self { + (*self as u32).ct_select(&(*other as u32), choice) as usize + } + + #[cfg(target_pointer_width = "64")] + #[inline] + fn ct_select(&self, other: &Self, choice: Choice) -> Self { + (*self as u64).ct_select(&(*other as u64), choice) as usize + } +} + +impl CtSelect for cmp::Ordering { + fn ct_select(&self, other: &Self, choice: Choice) -> Self { + // `Ordering` is `#[repr(i8)]` where: + // + // - `Less` => -1 + // - `Equal` => 0 + // - `Greater` => 1 + // + // Given this, it's possible to operate on orderings as if they're `i8`, which allows us to + // use the `CtSelect` impl on `i8` to select between them. + let ret = (*self as i8).ct_select(&(*other as i8), choice); + + // SAFETY: `Ordering` is `#[repr(i8)]` and `ret` has been assigned to + // a value which was originally a valid `Ordering` then cast to `i8` + #[allow(trivial_casts, unsafe_code)] + unsafe { + *(&ret as *const i8).cast::() + } + } +} + +impl CtSelect for [T; N] +where + T: CtSelect, +{ + #[inline] + fn ct_select(&self, other: &Self, choice: Choice) -> Self { + core::array::from_fn(|i| T::ct_select(&self[i], &other[i], choice)) + } + + fn ct_assign(&mut self, other: &Self, choice: Choice) { + for (a, b) in self.iter_mut().zip(other) { + a.ct_assign(b, choice) + } + } +} + +#[cfg(test)] +mod tests { + use super::{Choice, CtSelect, cmp}; + + macro_rules! ct_select_test { + ($ty:ty, $name:ident) => { + #[test] + fn $name() { + let a: $ty = 1; + let b: $ty = 2; + assert_eq!(a.ct_select(&b, Choice::FALSE), a); + assert_eq!(a.ct_select(&b, Choice::TRUE), b); + } + }; + } + + ct_select_test!(u8, u8_ct_select); + ct_select_test!(u16, u16_ct_select); + ct_select_test!(u32, u32_ct_select); + ct_select_test!(u64, u64_ct_select); + ct_select_test!(u128, u128_ct_select); + + #[test] + fn ordering_ct_select() { + let a = cmp::Ordering::Less; + let b = cmp::Ordering::Greater; + assert_eq!(a.ct_select(&b, Choice::FALSE), a); + assert_eq!(a.ct_select(&b, Choice::TRUE), b); + } +}