From c61d5be86e3efb978883fc60687af42192aacaff Mon Sep 17 00:00:00 2001 From: Jason Gross Date: Mon, 14 Jan 2019 19:05:15 -0500 Subject: Don't cast signed to unsigned before shifting Unfortunately, signed->unsigned casts do not commute with shifts. We take care to only extend the range when it needs extending, now. This was previously causing issues with subborrow. We should really get proofs about casts in C semantics at some point soon. Fixes #489 --- curve25519_64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'curve25519_64.c') diff --git a/curve25519_64.c b/curve25519_64.c index ed90d1ce3..3a637743e 100644 --- a/curve25519_64.c +++ b/curve25519_64.c @@ -41,7 +41,7 @@ static void fiat_25519_addcarryx_u51(uint64_t* out1, fiat_25519_uint1* out2, fia */ static void fiat_25519_subborrowx_u51(uint64_t* out1, fiat_25519_uint1* out2, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) { int64_t x1 = ((int64_t)(arg2 - (int64_t)arg1) - (int64_t)arg3); - fiat_25519_int1 x2 = (fiat_25519_int1)((uint64_t)x1 >> 51); + fiat_25519_int1 x2 = (fiat_25519_int1)((fiat_25519_int128)x1 >> 51); uint64_t x3 = (x1 & UINT64_C(0x7ffffffffffff)); *out1 = x3; *out2 = (fiat_25519_uint1)(0x0 - x2); -- cgit v1.2.3