From 18b0b3c4b56ee7b81838b5f2dc4a7f1655de0cdb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 8 Jun 2020 09:53:20 +0200 Subject: [PATCH] Avoid superflous randomization with restartable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Checking the budget only after the randomization is done means sometimes we were randomizing first, then noticing we ran out of budget, return, come back and randomize again before we finally normalize. While this is fine from a correctness and security perspective, it's a minor inefficiency, and can also be disconcerting while debugging, so we might as well avoid it. Signed-off-by: Manuel Pégourié-Gonnard --- library/ecp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/ecp.c b/library/ecp.c index 9b6efe5d3..67f399f1e 100644 --- a/library/ecp.c +++ b/library/ecp.c @@ -2073,6 +2073,7 @@ static int ecp_mul_comb_after_precomp( const mbedtls_ecp_group *grp, rs_ctx->rsm->state = ecp_rsm_final_norm; final_norm: + MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV ); #endif /* * Knowledge of the jacobian coordinates may leak the last few bits of the @@ -2090,7 +2091,6 @@ final_norm: #endif MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, RR, f_rng, p_rng ) ); - MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV ); MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, RR ) ); #if defined(MBEDTLS_ECP_RESTARTABLE)