Repository navigation
Conversation
SparkiDev
force-pushed
the
eccsi_sign_blind_invmod
branch
from
November 12, 2026 23:30
f4235ba to
b0a33a0
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Targeted tests are missing to verify error propagation, secret zeroization, and successful signing and verification after recovery from blinding, inversion, and unblinding failures.
1 open issue
What changed in this PR
This PR hardens wolfCrypt’s ECCSI signing by blinding the secret-dependent modular inversion and extending ephemeral-key cleanup to failure paths.
Changes:
- Generate a random non-zero blinding value, apply it around inversion, and erase it afterward.
- Erase the ephemeral signing key on all paths after generation.
| File | Description |
|---|---|
wolfcrypt/src/eccsi.c |
Adds inversion blinding and broadens secret cleanup in wc_SignEccsiHash(). |
Review effort: Balanced
|
SparkiDev
force-pushed
the
eccsi_sign_blind_invmod
branch
from
November 13, 2026 00:17
b0a33a0 to
d8b9280
Compare
Contributor
Author
SparkiDev
force-pushed
the
eccsi_sign_blind_invmod
branch
from
November 13, 2026 00:55
d8b9280 to
987dd9a
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new x86-64 path converts the unblinded secret using operand-dependent division, exposing secret-dependent timing on affected CPUs and requiring fixed-time conversion or retention of the blinded path.
1 open issue
3 resolved since last review
Review effort: Balanced
SparkiDev
force-pushed
the
eccsi_sign_blind_invmod
branch
from
November 13, 2026 01:11
987dd9a to
98faff7
Compare
SparkiDev
force-pushed
the
eccsi_sign_blind_invmod
branch
from
November 13, 2026 02:04
98faff7 to
f95e9d6
Compare
Return only s' from SP, which is public, rather than s^-1 - converting a secret to an mp_int clamps it, which is not constant time. Convert to Montgomery form by multiplying by R^2 rather than with division, and reduce the result modulo the order before returning it. Also drops the generic multiply by j. Use the key's heap for SP allocations. Regenerated SP code: converting an mp_int with digits narrower than the SP word now loops a fixed number of times with masked reads. Add white-box tests that fail each step 5 operation after j is generated and check the error is returned, the blind and j are erased, and signing and verification succeed afterwards.
SparkiDev
force-pushed
the
eccsi_sign_blind_invmod
branch
from
November 13, 2026 03:07
f95e9d6 to
9e79194
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
wc_SignEccsiHash() inverted s = HE + r * SSK mod q with mp_invmod(), which is not constant time. The value depends on the secret signing key and the ephemeral nonce.
Multiply s by a random non-zero blinding value b before inverting and multiply the result by b afterwards, as is done for ECDSA signing. The blinding value is zeroized after use. Also erase the ephemeral key j on all paths after it is generated, not only when the inversion succeeds.
Fixes zd#22802
Testing
./configure --enable-eccsi