@amritk/nish-x86_64-linux 0.14.0 → 0.16.0

package/std/crypto/sha256.ts

@@ -435,8 +435,19 @@ export class Sha256 {
   }
 }
 
-/** The SHA-256 digest of all of `data`, as a fresh 32-byte array. */
+/**
+ * The SHA-256 digest of all of `data`, as a fresh 32-byte array.
+ *
+ * An array longer than 2^31 - 1 bytes panics. A window's length is an `i32`,
+ * and under `--number-mode f64` `toI32` of a longer length saturates, so
+ * hashing `toI32(data.length)` bytes would answer the digest of a prefix: one
+ * digest for every message that shares its first 2^31 - 1 bytes. The length
+ * is compared as the `number` it is, before any `toI32`.
+ */
 export const sha256 = (data: u8[]): u8[] => {
+  if (data.length > 2147483647) {
+    panic("sha256: a message longer than 2^31 - 1 bytes")
+  }
   const hasher: Sha256 = new Sha256()
   const from: i32 = 0
   hasher.update(data, from, toI32(data.length))

package/std/crypto/sha512.ts

@@ -495,15 +495,29 @@ export class Sha384 {
   }
 }
 
-/** The SHA-512 digest of all of `data`, as a fresh 64-byte array. */
+/**
+ * The SHA-512 digest of all of `data`, as a fresh 64-byte array. An array
+ * longer than 2^31 - 1 bytes panics, for the reason `sha256` gives: a longer
+ * length does not survive `toI32` under `--number-mode f64`, and the digest
+ * would be of a prefix.
+ */
 export const sha512 = (data: u8[]): u8[] => {
+  if (data.length > 2147483647) {
+    panic("sha512: a message longer than 2^31 - 1 bytes")
+  }
   const hasher = new Sha512()
   hasher.update(data, OFFSET_ZERO, toI32(data.length))
   return hasher.digest()
 }
 
-/** The SHA-384 digest of all of `data`, as a fresh 48-byte array. */
+/**
+ * The SHA-384 digest of all of `data`, as a fresh 48-byte array. An array
+ * longer than 2^31 - 1 bytes panics, as in `sha512`.
+ */
 export const sha384 = (data: u8[]): u8[] => {
+  if (data.length > 2147483647) {
+    panic("sha384: a message longer than 2^31 - 1 bytes")
+  }
   const hasher = new Sha384()
   hasher.update(data, OFFSET_ZERO, toI32(data.length))
   return hasher.digest()

package/std/crypto/x25519.ts

@@ -26,13 +26,28 @@
  * nicety: each function states what it accepts and what it answers, and
  * `f25519Mul` says why its sums fit.
  *
- * **Constant time, by construction and not yet by proof.** Nothing branches
- * on, or indexes by, a secret: the ladder swaps with a mask and runs all 255
- * steps whatever the scalar, and the final reduction subtracts p by adding a
- * carry bit times 19 rather than by comparing. Every `if` and every loop bound
- * here is on a public quantity — a limb number, a bit position or an input
- * length. WP34 N6's `ctSelect` and its disassembly check are what will verify
- * that; they do not exist yet.
+ * **Constant time, by construction, and in part by disassembly.** Nothing
+ * branches on, or indexes by, a secret: the ladder swaps with a mask and runs
+ * all 255 steps whatever the scalar, and the final reduction subtracts p by
+ * adding a carry bit times 19 rather than by comparing. Every `if` and every
+ * loop bound here is on a public quantity — a limb number, a bit position or
+ * an input length.
+ *
+ * WP34 N6's disassembly check (`tests/ct-asm.js`) verifies the part a secret
+ * flows through: `tests/cases/ct_asm_x25519` holds copies of `f25519Mul`,
+ * `f25519Square`, `f25519MulA24`, `f25519Add`, `f25519Sub`, `f25519Swap` and
+ * one pass of `x25519Ladder`'s loop, and the check reads each one's `clang -O2`
+ * machine code for x86-64 and aarch64 and finds no branch and no load or store
+ * at an address the scalar bit or a limb reaches. They are copies because the
+ * check refuses every branch, loop back-edges included, and this module's own
+ * functions keep their loops and the early `return`s below; the copies drop the
+ * guards and write `f25519Mul`'s outer loop out a row at a time, and the
+ * fixture's `main` holds them to the same RFC 7748 vectors as this module. A
+ * change to one of those functions belongs in that fixture too. What stays
+ * discipline rather than proof is the rest: the loops around the step,
+ * `f25519Decode`, `f25519Encode` and `f25519Invert`, whose branches are all on
+ * public positions. Weekly, `tests/ct-timing.js` times the fixture's functions
+ * on real x86-64 and aarch64 hardware as well.
  *
  * **Loop bounds are literals.** A field element is always ten limbs and an
  * encoding always 32 bytes, and each function that indexes one opens with an
@@ -465,9 +480,10 @@ const x25519Ladder = (k: u8[], u: i64[]): u8[] => {
  *
  * Answers `null` unless both arguments are exactly `X25519_SIZE` bytes. An
  * all-zero answer is **returned, not refused**: it is what a low-order `u`
- * gives, and RFC 7748 §6.1 leaves checking for it to the protocol, which is
- * where TLS 1.3 (WP34 T1) makes that check. A caller doing a key exchange
- * outside TLS should make it too.
+ * gives, and RFC 7748 §6.1 leaves checking for it to the protocol. Nothing in
+ * this tree makes that check for you yet (TLS 1.3, WP34 T1, is planned to), so
+ * every caller doing a key exchange must refuse an all-zero answer itself —
+ * with `timingSafeEqual` against 32 zero bytes, since the answer is a secret.
  */
 export const x25519 = (scalar: u8[], u: u8[]): u8[] | null => {
   if (toI32(scalar.length) !== 32 || toI32(u.length) !== 32) {