ctutils: Thumb-1 constant-time hardening

.github/workflows/ctutils.yml

@@ -50,6 +50,11 @@ jobs:
 
   checkct:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        overflow-checks: ["false", "true"]
+    env:
+      CARGO_PROFILE_RELEASE_OVERFLOW_CHECKS: ${{ matrix.overflow-checks }}
     steps:
       - uses: actions/checkout@v7
       - uses: Ledger-Donjon/cargo-checkct@85271e5ce9eab9ba895c62c8b5d4129810a635a0
@@ -80,6 +85,9 @@ jobs:
       - run: cargo test --features subtle
       - run: cargo test --all-features
       - run: cargo test --all-features --release
+      - run: cargo test --all-features --release
+        env:
+          CARGO_PROFILE_RELEASE_OVERFLOW_CHECKS: true
 
   # Test using `cargo careful`
   test-careful:

ctutils/checkct/driver/src/driver.rs

@@ -11,6 +11,9 @@ macro_rules! private_integer {
     }};
 }
 
+mod comparisons;
+mod composition;
+mod negation;
 mod predicates;
 mod primitives;
 
@@ -56,7 +59,7 @@ macro_rules! scalar_checks {
 
             /// Compare the const helper with the cmov-backed trait on the same expression.
             #[checkct]
-            pub fn ct_select_after_lt() {
+            pub fn ct_select_after_choice_lt() {
                 let (a, b, _) = inputs();
                 black_box(select_min_with_ct_select(a, b));
             }

ctutils/checkct/driver/src/driver/comparisons.rs

@@ -0,0 +1,112 @@
+//! Comparison operations.
+
+use super::*;
+use ctutils::{CtGt, CtLt};
+
+macro_rules! comparison_checks {
+    ($module:ident, $ty:ty) => {
+        mod $module {
+            use super::*;
+
+            fn inputs() -> ($ty, $ty) {
+                // Keep both RNG hooks linked: the BINSEC script uses both.
+                black_box(PublicRng.next_u32());
+                (private_integer!($ty), private_integer!($ty))
+            }
+
+            #[checkct]
+            pub fn ct_lt() {
+                let (a, b) = inputs();
+                black_box(a.ct_lt(&b).to_u8());
+            }
+
+            #[checkct]
+            pub fn ct_gt() {
+                let (a, b) = inputs();
+                black_box(a.ct_gt(&b).to_u8());
+            }
+
+            #[checkct]
+            pub fn ct_select_after_lt() {
+                let (a, b) = inputs();
+                black_box(b.ct_select(&a, a.ct_lt(&b)));
+            }
+
+            #[checkct]
+            pub fn ct_select_after_gt() {
+                let (a, b) = inputs();
+                black_box(b.ct_select(&a, a.ct_gt(&b)));
+            }
+
+            #[checkct]
+            pub fn ct_select_independent_after_lt() {
+                let (a, b) = inputs();
+                let (x, y) = inputs();
+                black_box(x.ct_select(&y, a.ct_lt(&b)));
+            }
+
+            #[checkct]
+            pub fn ct_select_independent_after_gt() {
+                let (a, b) = inputs();
+                let (x, y) = inputs();
+                black_box(x.ct_select(&y, a.ct_gt(&b)));
+            }
+
+            #[checkct]
+            pub fn ct_select_after_lt_constant() {
+                let (value, _) = inputs();
+                let value = value & 63;
+                black_box(value.ct_select(&2, (2 as $ty).ct_lt(&value)));
+            }
+
+            #[checkct]
+            pub fn ct_select_after_gt_constant() {
+                let (value, _) = inputs();
+                let value = value & 63;
+                black_box(value.ct_select(&2, (2 as $ty).ct_gt(&value)));
+            }
+        }
+    };
+}
+
+comparison_checks!(u8_ops, u8);
+comparison_checks!(u16_ops, u16);
+comparison_checks!(u32_ops, u32);
+comparison_checks!(u64_ops, u64);
+comparison_checks!(u128_ops, u128);
+comparison_checks!(usize_ops, usize);
+
+macro_rules! constructor_checks {
+    ($module:ident, $ty:ty, $from_lt:ident) => {
+        mod $module {
+            use super::*;
+
+            fn private() -> $ty {
+                black_box(PublicRng.next_u32());
+                private_integer!($ty)
+            }
+
+            #[checkct]
+            pub fn constant_lhs() {
+                black_box(Choice::$from_lt(2, private() & 63).to_u8());
+            }
+
+            #[checkct]
+            pub fn constant_rhs() {
+                black_box(Choice::$from_lt(private() & 63, 2).to_u8());
+            }
+
+            #[checkct]
+            pub fn select_constant() {
+                let value = private() & 63;
+                black_box(value.ct_select(&2, Choice::$from_lt(2, value)));
+            }
+        }
+    };
+}
+
+constructor_checks!(u8_choice, u8, from_u8_lt);
+constructor_checks!(u16_choice, u16, from_u16_lt);
+constructor_checks!(u32_choice, u32, from_u32_lt);
+constructor_checks!(u64_choice, u64, from_u64_lt);
+constructor_checks!(u128_choice, u128, from_u128_lt);

ctutils/checkct/driver/src/driver/composition.rs

@@ -0,0 +1,127 @@
+//! Scalar predicates composed with selection, containers, and wrappers.
+
+use super::*;
+use ctutils::{CtEq, CtFind, CtGt, CtLookup, CtLt, CtOption};
+
+fn condition() -> Choice {
+    Choice::from_u8_lsb(private_integer!(u8))
+}
+
+macro_rules! composition_checks {
+    ($module:ident, $ty:ty) => {
+        mod $module {
+            use super::*;
+
+            fn private() -> $ty {
+                black_box(PublicRng.next_u32());
+                private_integer!($ty)
+            }
+
+            fn array() -> [$ty; 4] {
+                core::array::from_fn(|_| private())
+            }
+
+            fn option() -> CtOption<$ty> {
+                CtOption::new(private(), condition())
+            }
+
+            #[checkct]
+            pub fn equality_select() {
+                let (a, b) = (private(), private());
+                black_box(a.ct_select(&b, a.ct_eq(&b)));
+                black_box(a.ct_ne(&b).to_u8());
+            }
+
+            #[checkct]
+            pub fn array_select() {
+                black_box(array().ct_select(&array(), condition()));
+            }
+
+            #[checkct]
+            pub fn array_equality() {
+                black_box(array().ct_eq(&array()).to_u8());
+            }
+
+            #[checkct]
+            pub fn option_unwrap_or() {
+                black_box(option().unwrap_or(private()));
+            }
+
+            #[checkct]
+            pub fn option_or() {
+                black_box(option().or(option()).unwrap_or(private()));
+            }
+
+            #[checkct]
+            pub fn option_and_then() {
+                let other = option();
+                black_box(option().and_then(|_| other).unwrap_or(private()));
+            }
+
+            #[checkct]
+            pub fn option_equality() {
+                black_box(option().ct_eq(&option()).to_u8());
+            }
+
+            #[checkct]
+            pub fn option_select() {
+                let selected = option().ct_select(&option(), condition());
+                black_box(selected.is_some().to_u8());
+                black_box(selected.unwrap_or(private()));
+            }
+
+            #[checkct]
+            pub fn lookup() {
+                // An unrestricted secret index includes every hit and out-of-range miss.
+                let index = private_integer!(usize);
+                let found = array().ct_lookup(index);
+                black_box(found.is_some().to_u8());
+                black_box(found.unwrap_or(private()));
+            }
+
+            #[checkct]
+            pub fn find() {
+                // Includes no match, multiple matches, and first/last matches.
+                let needle = private();
+                let found = array().ct_find(|value| value.ct_eq(&needle));
+                black_box(found.is_some().to_u8());
+                black_box(found.unwrap_or(private()));
+            }
+        }
+    };
+}
+
+composition_checks!(u32_ops, u32);
+composition_checks!(u64_ops, u64);
+
+macro_rules! nonzero_comparison_checks {
+    ($module:ident, $ty:ident, $int:ty) => {
+        mod $module {
+            use super::*;
+
+            fn private() -> core::num::$ty {
+                black_box(PublicRng.next_u32());
+                core::num::$ty::new(private_integer!($int) | 1).expect("low bit is set")
+            }
+
+            #[checkct]
+            pub fn select_after_lt() {
+                let (a, b) = (private(), private());
+                black_box(b.ct_select(&a, a.ct_lt(&b)));
+            }
+
+            #[checkct]
+            pub fn select_after_gt() {
+                let (a, b) = (private(), private());
+                black_box(b.ct_select(&a, a.ct_gt(&b)));
+            }
+        }
+    };
+}
+
+nonzero_comparison_checks!(nonzero_u8, NonZeroU8, u8);
+nonzero_comparison_checks!(nonzero_u16, NonZeroU16, u16);
+nonzero_comparison_checks!(nonzero_u32, NonZeroU32, u32);
+nonzero_comparison_checks!(nonzero_u64, NonZeroU64, u64);
+nonzero_comparison_checks!(nonzero_u128, NonZeroU128, u128);
+nonzero_comparison_checks!(nonzero_usize, NonZeroUsize, usize);

ctutils/checkct/driver/src/driver/negation.rs

@@ -0,0 +1,73 @@
+//! Negation operations.
+
+// Run with and without `CARGO_PROFILE_RELEASE_OVERFLOW_CHECKS=true`. Secret inputs include MIN.
+// A public false condition must not trigger a secret-dependent overflow check while eagerly
+// computing the other operand.
+
+use super::*;
+use ctutils::CtNeg;
+
+macro_rules! negation_checks {
+    ($module:ident, $ty:ty, $input:expr) => {
+        mod $module {
+            use super::*;
+
+            fn inputs() -> ($ty, Choice) {
+                black_box(PublicRng.next_u32());
+                ($input, Choice::from_u8_lsb(private_integer!(u8)))
+            }
+
+            #[checkct]
+            pub fn ct_neg() {
+                let (value, choice) = inputs();
+                black_box(value.ct_neg(choice));
+            }
+
+            #[checkct]
+            pub fn ct_neg_assign() {
+                let (mut value, choice) = inputs();
+                value.ct_neg_assign(choice);
+                black_box(value);
+            }
+
+            #[checkct]
+            pub fn ct_neg_false() {
+                let (value, _) = inputs();
+                black_box(value.ct_neg(Choice::FALSE));
+            }
+
+            #[checkct]
+            pub fn ct_neg_assign_false() {
+                let (mut value, _) = inputs();
+                value.ct_neg_assign(Choice::FALSE);
+                black_box(value);
+            }
+        }
+    };
+}
+
+negation_checks!(i8_ops, i8, private_integer!(i8));
+negation_checks!(i16_ops, i16, private_integer!(i16));
+negation_checks!(i32_ops, i32, private_integer!(i32));
+negation_checks!(i64_ops, i64, private_integer!(i64));
+negation_checks!(i128_ops, i128, private_integer!(i128));
+negation_checks!(isize_ops, isize, private_integer!(isize));
+
+// Setting the sign bit guarantees NonZero's invariant without excluding MIN or introducing a
+// secret-dependent branch in the harness.
+macro_rules! nonzero_checks {
+    ($module:ident, $ty:ident, $int:ty) => {
+        negation_checks!(
+            $module,
+            core::num::$ty,
+            core::num::$ty::new(private_integer!($int) | <$int>::MIN).expect("sign bit is set")
+        );
+    };
+}
+
+nonzero_checks!(nonzero_i8, NonZeroI8, i8);
+nonzero_checks!(nonzero_i16, NonZeroI16, i16);
+nonzero_checks!(nonzero_i32, NonZeroI32, i32);
+nonzero_checks!(nonzero_i64, NonZeroI64, i64);
+nonzero_checks!(nonzero_i128, NonZeroI128, i128);
+nonzero_checks!(nonzero_isize, NonZeroIsize, isize);