ecdsa_ext 0.5.1 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 344f77af4186a6c073efd7ceb86c1023f9395921e360a6239e6443aeaf31c957
-  data.tar.gz: e9a32a697a607c61dd7f7993975eea458bfb09ccd1445ebe9715809b6c3620d5
+  metadata.gz: f8ae635cb030065845eb7e0e08d33adb64c96789e75f8e9b6eac37566e36e4d0
+  data.tar.gz: e4d993a63966e99d63df34b586dbc28f05e6ad093e0aa1d96134eefa93b7bad3
 SHA512:
-  metadata.gz: b45f1ef8661a6b1a6a3b222f29b8ed5b95dbf90576040bc6cef13f295b496017508867d1ae0a6ef14c51310d349e6b01d881ba9e8f151b5fa01bc02bb6f04093
-  data.tar.gz: e5717cb07126434a13051d760a9b2c797f6834d7e95a31a2ec433128480f55a40b2cf8e4d336913781319858e0fc7de30a00832bd3810a624a67498a9cab08ef
+  metadata.gz: 8ac2e8f9cc036bede6914415e81526fd82788c476ed4694e38841ea0c91176df0148b39fee7ded35c8be4fa520d0f4e9f6c53fd515397a44a14d24bc1ccef8ed
+  data.tar.gz: 5f3e6b6fd617492d8b8f7b8510341ffdc6fea4f16b2bac040fca0c6064d34201cba346474a78db663757d2e909a6095abb75ce3022d13da0145ca3838a302eae

data/.rubocop.yml

@@ -2,7 +2,7 @@ require:
   - rubocop-rake
   - rubocop-rspec
 inherit_gem:
-  prettier: rubocop.yml
+  syntax_tree: config/rubocop.yml
 AllCops:
   TargetRubyVersion: 2.7
 RSpec/ExampleLength:
@@ -17,5 +17,6 @@ Style/WhileUntilModifier:
   Enabled: false
 Naming/MethodParameterName:
   Enabled: false
-RSpec/FilePath:
-  Enabled: false
+RSpec/SpecFilePathFormat:
+  Exclude:
+    - 'spec/ecdsa/ext/point_spec.rb'

data/.ruby-version

@@ -1 +1 @@
-ruby-3.3.0
+ruby-4.0.0

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 ## [Unreleased]
 
+## [0.6.0] - 2026-11-01
+
+- Fix `==` of `ProjectivePoint`/`JacobianPoint` to return false for points on different groups
+- Add `eql?` and `hash` to `AbstractPoint` so that points can be used as Hash keys consistently with `==`
+- Fix the number of iterations in `multiply_by_scalar` to depend only on the bit length of the scalar, and document that signing is still not constant time
+- Raise `ArgumentError` in `ECDSA.sign` when `temporary_key` is not in the range [1, n-1]
+- Raise `ArgumentError` when constructing a point with z = 0 (use `infinity_point` instead)
+- Make `ecdsa/ext/sign_verify` require `ecdsa_ext` itself so it can be required standalone
+- Rewrite `sig/ecdsa_ext.rbs` to describe the actual API
+
+## [0.5.2] - 2026-08-07
+
+- Fix a timing leak of the ephemeral key's bit length in `ECDSA.sign` by padding the scalar with the group order
+- Check r and s against the range [1, n-1] (group order) instead of the curve's prime field in `ECDSA.check_signature!`
+- Fix `NoMethodError` when comparing an infinity point with a non-infinity point via `==`
+
 ## [0.1.0] - 2023-02-23
 
 - Initial release

data/Gemfile

@@ -9,9 +9,15 @@ gem "rake", "~> 13.0"
 
 gem "rspec", "~> 3.0"
 
-gem 'prettier', '4.0.3'
+gem "syntax_tree"
 
-gem 'rubocop-rake'
-gem 'rubocop-rspec'
+gem "rubocop-rake"
+gem "rubocop-rspec"
 
-gem 'benchmark-ips'
+gem "benchmark-ips"
+
+# Bundled gems removed from default gems in Ruby 3.5/4.0.
+gem "base64"
+gem "benchmark"
+gem "ostruct"
+gem "racc"

data/README.md

@@ -6,6 +6,11 @@ which mainly speeds up the computation of points on elliptic curves by using pro
 This gem was not written by a cryptography expert and has not been carefully checked as with the original gem.
 It is provided "as is" and it is the user's responsibility to make sure it will be suitable for the desired purpose.
 
+In particular, this gem does **not** provide resistance against timing or other side-channel attacks.
+Scalar multiplication uses a data-dependent NAF add/subtract pattern, the modular inverse is computed with
+a variable-time algorithm, and Ruby's `Integer` arithmetic itself is not constant time.
+Do not use this gem in an environment where an attacker can observe the timing of signing operations.
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -92,3 +97,7 @@ add the following code. This code is a monkey patch to do the existing process i
 ```ruby
 require 'ecdsa/ext/sign_verify'
 ```
+
+Note that `ECDSA.sign` provided by this patch is not constant time (see the disclaimer at the top of this README).
+It only pads the ephemeral key so that the number of loop iterations in scalar multiplication is fixed,
+which is a partial mitigation and not a substitute for a constant-time implementation.

data/lib/ecdsa/ext/abstract_point.rb

@@ -20,6 +20,10 @@ module ECDSA
           raise ArgumentError, "Invalid x: #{x.inspect}" unless x.is_a?(Integer)
           raise ArgumentError, "Invalid y: #{y.inspect}" unless y.is_a?(Integer)
           raise ArgumentError, "Invalid z: #{z.inspect}" unless z.is_a?(Integer)
+          if z.zero?
+            raise ArgumentError,
+                  "z must not be zero. Use infinity_point for the point at infinity."
+          end
         end
       end
 
@@ -79,7 +83,10 @@ module ECDSA
         q = self.class.infinity_point(group)
         v = self
         p, n = to_naf(x)
-        len = [p.bit_length, n.bit_length].max
+        # The NAF of x has at most x.bit_length + 1 digits. Using that bound
+        # instead of the actual NAF length keeps the number of iterations
+        # dependent only on the bit length of x.
+        len = x.bit_length + 1
         len.times do
           q += v if p.odd?
           q += v.negate if n.odd?
@@ -107,6 +114,23 @@ module ECDSA
         raise NotImplementedError
       end
 
+      # Check whether same point or not.
+      # @param [Object] other
+      # @return [Boolean]
+      def eql?(other)
+        self == other
+      end
+
+      # Return hash value consistent with #==.
+      # Projective representations are not unique, so the hash is computed
+      # from the affine coordinates.
+      # @return [Integer]
+      def hash
+        return [self.class, group, :infinity].hash if infinity?
+        affine = to_affine
+        [self.class, group, affine.x, affine.y].hash
+      end
+
       private
 
       # Convert Integer to NAF

data/lib/ecdsa/ext/jacobian_point.rb

@@ -70,7 +70,9 @@ module ECDSA
       # @return [Boolean]
       def ==(other)
         return false unless other.is_a?(JacobianPoint)
+        return false unless other.group == group
         return true if infinity? && other.infinity?
+        return false if infinity? || other.infinity?
 
         zz = field.square(z)
         other_zz = field.square(other.z)

data/lib/ecdsa/ext/projective_point.rb

@@ -67,7 +67,9 @@ module ECDSA
 
       def ==(other)
         return false unless other.is_a?(ProjectivePoint)
+        return false unless other.group == group
         return true if infinity? && other.infinity?
+        return false if infinity? || other.infinity?
 
         lhs_x = field.mod(x * other.z)
         rhs_x = field.mod(other.x * z)

data/lib/ecdsa/ext/sign_verify.rb

@@ -1,11 +1,29 @@
 # frozen_string_literal: true
 
+require_relative "../../ecdsa_ext"
+
 # A monkey patch to allow signature generation and verification of existing ECDSA with Jacobian coordinates.
 module ECDSA
   def self.sign(group, private_key, digest, temporary_key)
+    unless temporary_key.is_a?(Integer)
+      raise ArgumentError, "temporary_key is not an integer."
+    end
+    unless temporary_key.positive? && temporary_key < group.order
+      raise ArgumentError, "temporary_key must be in the range [1, n-1]."
+    end
+
     # Second part of step 1: Select ephemeral elliptic curve key pair
     # temporary_key was already selected for us by the caller
-    r_point = (group.generator.to_jacobian * temporary_key).to_affine
+    # Pad the scalar with the group order so that its bit length, and thus
+    # the number of iterations in multiply_by_scalar, is fixed.
+    # Since (k + i * n)G = kG, this does not change the result.
+    # NOTE: This is only a partial mitigation of timing leaks. The NAF
+    # add/subtract pattern, the modular inverse of temporary_key and Ruby's
+    # Integer arithmetic are still data-dependent, so signing is not
+    # constant time.
+    k = temporary_key + group.order
+    k += group.order if k.bit_length == group.order.bit_length
+    r_point = (group.generator.to_jacobian * k).to_affine
 
     # Steps 2 and 3
     point_field = PrimeField.new(group.order)
@@ -29,13 +47,13 @@ module ECDSA
 
   def self.check_signature!(public_key, digest, signature)
     group = public_key.group
-    field = group.field
+    point_field = PrimeField.new(group.order)
 
-    # Step 1: r and s must be in the field and non-zero
-    unless field.include?(signature.r)
+    # Step 1: r and s must be in the range [1, n-1].
+    unless point_field.include?(signature.r)
       raise InvalidSignatureError, "Invalid signature: r is not in the field."
     end
-    unless field.include?(signature.s)
+    unless point_field.include?(signature.s)
       raise InvalidSignatureError, "Invalid signature: s is not in the field."
     end
     if signature.r.zero?
@@ -51,7 +69,6 @@ module ECDSA
     e = normalize_digest(digest, group.bit_length)
 
     # Step 4
-    point_field = PrimeField.new(group.order)
     s_inverted = point_field.inverse(signature.s)
     u1 = point_field.mod(e * s_inverted)
     u2 = point_field.mod(signature.r * s_inverted)

data/lib/ecdsa/ext/version.rb

@@ -2,6 +2,6 @@
 
 module ECDSA
   module Ext
-    VERSION = "0.5.1"
+    VERSION = "0.6.0"
   end
 end

data/sig/ecdsa_ext.rbs

@@ -1,4 +1,57 @@
-module EcdsaExt
-  VERSION: String
-  # See the writing guide of rbs: https://github.com/ruby/rbs#guides
+# Type signatures for ecdsa_ext.
+# The ecdsa gem does not ship signatures, so the classes it defines that are
+# referenced here (Group, Point, PrimeField) are declared minimally.
+module ECDSA
+  class Group
+  end
+
+  class PrimeField
+  end
+
+  class Point
+    def to_projective: () -> Ext::ProjectivePoint
+    def to_jacobian: () -> Ext::JacobianPoint
+    def to_hex: (?bool compression) -> String
+  end
+
+  module Ext
+    VERSION: String
+
+    class AbstractPoint
+      attr_reader group: Group
+      attr_reader x: Integer?
+      attr_reader y: Integer?
+      attr_reader z: Integer?
+      attr_reader infinity: bool
+
+      def initialize: (Group group, *untyped args) -> void
+      def self.from_affine: (Point point) -> instance
+      def self.infinity_point: (Group group) -> instance
+      def field: () -> PrimeField
+      def infinity_point: () -> self
+      def infinity?: () -> bool
+      def negate: () -> self
+      def coords: () -> [Integer?, Integer?, Integer?]
+      def multiply_by_scalar: (Integer x) -> self
+      def *: (Integer x) -> self
+      def add_to_point: (self other) -> self
+      def double: () -> self
+      def to_affine: () -> Point
+      def ==: (untyped other) -> bool
+      def eql?: (untyped other) -> bool
+      def hash: () -> Integer
+
+      private
+
+      def to_naf: (Integer x) -> [Integer, Integer]
+    end
+
+    class ProjectivePoint < AbstractPoint
+      def +: (ProjectivePoint other) -> ProjectivePoint
+    end
+
+    class JacobianPoint < AbstractPoint
+      def +: (JacobianPoint other) -> JacobianPoint
+    end
+  end
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ecdsa_ext
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.6.0
 platform: ruby
 authors:
 - azuchi
-autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-02-08 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ecdsa
@@ -31,7 +30,6 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".prettierignore"
 - ".rspec"
 - ".rubocop.yml"
 - ".ruby-gemset"
@@ -61,7 +59,6 @@ metadata:
   homepage_uri: https://github.com/azuchi/ruby_ecdsa_ext
   source_code_uri: https://github.com/azuchi/ruby_ecdsa_ext
   changelog_uri: https://github.com/azuchi/ruby_ecdsa_ext
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -76,8 +73,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.1
-signing_key: 
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Extension of the ecdsa gem.
 test_files: []

data/.prettierignore

@@ -1,2 +0,0 @@
-/bin
-/vendor