diff options
| author |  Jason Gross <jgross@mit.edu> | 2019-01-14 19:05:15 -0500 |
|---|---|---|
| committer |  Jason Gross <jasongross9@gmail.com> | 2019-01-15 14:00:52 -0500 |
| commit | c61d5be86e3efb978883fc60687af42192aacaff (patch) | |
| tree | ea7da7858e1561490b8795d8e71b21819fca4319 /curve25519_64.c | |
| parent | 8faf6852f5bb36f5c663386f7dfbd0ae258445f9 (diff) | |
Don't cast signed to unsigned before shifting
Unfortunately, signed->unsigned casts do not commute with shifts. We
take care to only extend the range when it needs extending, now. This
was previously causing issues with subborrow.
We should really get proofs about casts in C semantics at some point
soon.
Fixes #489
Diffstat (limited to 'curve25519_64.c')
| -rw-r--r-- | curve25519_64.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/curve25519_64.c b/curve25519_64.c index ed90d1ce3..3a637743e 100644 --- a/curve25519_64.c +++ b/curve25519_64.c @@ -41,7 +41,7 @@ static void fiat_25519_addcarryx_u51(uint64_t* out1, fiat_25519_uint1* out2, fia */ static void fiat_25519_subborrowx_u51(uint64_t* out1, fiat_25519_uint1* out2, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) { int64_t x1 = ((int64_t)(arg2 - (int64_t)arg1) - (int64_t)arg3); - fiat_25519_int1 x2 = (fiat_25519_int1)((uint64_t)x1 >> 51); + fiat_25519_int1 x2 = (fiat_25519_int1)((fiat_25519_int128)x1 >> 51); uint64_t x3 = (x1 & UINT64_C(0x7ffffffffffff)); *out1 = x3; *out2 = (fiat_25519_uint1)(0x0 - x2); |