elliptic-curve: bump ff + group to v0.11

crypto/Cargo.toml

@@ -17,7 +17,7 @@ edition = "2018"
 aead = { version = "0.4", optional = true, path = "../aead" }
 cipher = { version = "0.3", optional = true }
 digest = { version = "0.9", optional = true }
-elliptic-curve = { version = "0.10", optional = true, path = "../elliptic-curve" }
+elliptic-curve = { version = "=0.11.0-pre", optional = true, path = "../elliptic-curve" }
 mac = { version = "0.11", package = "crypto-mac", optional = true }
 password-hash = { version = "0.3", optional = true, path = "../password-hash" }
 signature = { version = "1.3.0", optional = true, default-features = false, path = "../signature" }

elliptic-curve/Cargo.toml

@@ -5,7 +5,7 @@ General purpose Elliptic Curve Cryptography (ECC) support, including types
 and traits for representing various elliptic curve forms, scalars, points,
 and public/secret keys composed thereof.
 """
-version    = "0.10.6" # Also update html_root_url in lib.rs when bumping this
+version    = "0.11.0-pre" # Also update html_root_url in lib.rs when bumping this
 authors    = ["RustCrypto Developers"]
 license    = "Apache-2.0 OR MIT"
 repository = "https://github.com/RustCrypto/traits/tree/master/elliptic-curve"
@@ -22,8 +22,8 @@ subtle = { version = "=2.4", default-features = false }
 
 # optional dependencies
 base64ct = { version = "1", optional = true, default-features = false }
-ff = { version = "0.10", optional = true, default-features = false }
-group = { version = "0.10", optional = true, default-features = false }
+ff = { version = "0.11", optional = true, default-features = false }
+group = { version = "0.11", optional = true, default-features = false }
 hex-literal = { version = "0.3", optional = true }
 pkcs8 = { version = "0.7", optional = true }
 serde = { version = "1", optional = true, default-features = false }

elliptic-curve/src/arithmetic.rs

@@ -25,14 +25,15 @@ pub trait AffineArithmetic: Curve + ScalarArithmetic {
 pub trait ProjectiveArithmetic: Curve + AffineArithmetic {
     /// Elliptic curve point in projective coordinates.
     ///
-    /// Note: the following bounds are enforced by [`group::Group`]:
-    /// - `Copy`
-    /// - `Clone`
-    /// - `Debug`
-    /// - `Eq`
-    /// - `Sized`
-    /// - `Send`
-    /// - `Sync`
+    /// Note: the following bounds are provided by [`group::Group`]:
+    /// - `'static`
+    /// - [`Copy`]
+    /// - [`Clone`]
+    /// - [`Debug`]
+    /// - [`Eq`]
+    /// - [`Sized`]
+    /// - [`Send`]
+    /// - [`Sync`]
     type ProjectivePoint: ConditionallySelectable
         + ConstantTimeEq
         + Default
@@ -48,13 +49,15 @@ pub trait ProjectiveArithmetic: Curve + AffineArithmetic {
 pub trait ScalarArithmetic: Curve {
     /// Scalar field type.
     ///
-    /// Note: the following bounds are enforced by [`ff::Field`]:
-    /// - `Copy`
-    /// - `Clone`
-    /// - `ConditionallySelectable`
-    /// - `Debug`
-    /// - `Default`
-    /// - `Send`
-    /// - `Sync`
-    type Scalar: ConstantTimeEq + ff::Field + ff::PrimeField<Repr = FieldBytes<Self>>;
+    /// Note: the following bounds are provided by [`ff::Field`]:
+    /// - `'static`
+    /// - [`Copy`]
+    /// - [`Clone`]
+    /// - [`ConditionallySelectable`]
+    /// - [`ConstantTimeEq`]
+    /// - [`Debug`]
+    /// - [`Default`]
+    /// - [`Send`]
+    /// - [`Sync`]
+    type Scalar: ff::Field + ff::PrimeField<Repr = FieldBytes<Self>>;
 }

elliptic-curve/src/dev.rs

@@ -6,13 +6,13 @@ use crate::{
     error::{Error, Result},
     rand_core::RngCore,
     sec1::{FromEncodedPoint, ToEncodedPoint},
-    subtle::{Choice, ConditionallySelectable, ConstantTimeEq, CtOption},
+    subtle::{Choice, ConditionallySelectable, ConstantTimeEq, ConstantTimeLess, CtOption},
     weierstrass,
     zeroize::Zeroize,
     AffineArithmetic, AlgorithmParameters, Curve, ProjectiveArithmetic, ScalarArithmetic,
 };
 use core::{
-    convert::{TryFrom, TryInto},
+    convert::TryFrom,
     iter::Sum,
     ops::{Add, AddAssign, Mul, MulAssign, Neg, Sub, SubAssign},
 };
@@ -104,8 +104,8 @@ impl Field for Scalar {
         Self(U256::ONE)
     }
 
-    fn is_zero(&self) -> bool {
-        self.0.is_zero().into()
+    fn is_zero(&self) -> Choice {
+        self.0.is_zero()
     }
 
     #[must_use]
@@ -134,15 +134,16 @@ impl PrimeField for Scalar {
     const CAPACITY: u32 = 255;
     const S: u32 = 4;
 
-    fn from_repr(bytes: FieldBytes) -> Option<Self> {
-        U256::from_be_byte_array(bytes).try_into().ok()
+    fn from_repr(bytes: FieldBytes) -> CtOption<Self> {
+        let inner = U256::from_be_byte_array(bytes);
+        CtOption::new(Scalar(inner), inner.ct_lt(&MockCurve::ORDER))
     }
 
     fn to_repr(&self) -> FieldBytes {
         self.0.to_be_byte_array()
     }
 
-    fn is_odd(&self) -> bool {
+    fn is_odd(&self) -> Choice {
         unimplemented!();
     }
 

elliptic-curve/src/lib.rs

@@ -16,7 +16,7 @@
 #![doc(
     html_logo_url = "https://raw.githubusercontent.com/RustCrypto/media/8f1a9894/logo.svg",
     html_favicon_url = "https://raw.githubusercontent.com/RustCrypto/media/8f1a9894/logo.svg",
-    html_root_url = "https://docs.rs/elliptic-curve/0.10.6"
+    html_root_url = "https://docs.rs/elliptic-curve/0.11.0-pre"
 )]
 
 #[cfg(feature = "alloc")]

elliptic-curve/src/scalar/bytes.rs

@@ -70,7 +70,7 @@ where
     where
         C: ProjectiveArithmetic,
     {
-        Scalar::<C>::from_repr(self.inner).expect("ScalarBytes order invariant violated")
+        Scalar::<C>::from_repr(self.inner).unwrap()
     }
 
     /// Borrow the inner [`FieldBytes`]
@@ -206,7 +206,7 @@ where
     type Error = Error;
 
     fn try_from(bytes: ScalarBytes<C>) -> Result<NonZeroScalar<C>> {
-        NonZeroScalar::<C>::from_repr(bytes.inner).ok_or(Error)
+        Option::from(NonZeroScalar::<C>::from_repr(bytes.inner)).ok_or(Error)
     }
 }
 

elliptic-curve/src/scalar/non_zero.rs

@@ -38,27 +38,24 @@ where
 {
     /// Generate a random `NonZeroScalar`
     pub fn random(mut rng: impl CryptoRng + RngCore) -> Self {
-        // Use rejection sampling to eliminate zero values
+        // Use rejection sampling to eliminate zero values.
+        // While this method isn't constant-time, the attacker shouldn't learn
+        // anything about unrelated outputs so long as `rng` is a secure `CryptoRng`.
         loop {
-            if let Some(result) = Self::new(Field::random(&mut rng)) {
+            if let Some(result) = Self::new(Field::random(&mut rng)).into() {
                 break result;
             }
         }
     }
 
     /// Decode a [`NonZeroScalar`] from a serialized field element
-    pub fn from_repr(repr: FieldBytes<C>) -> Option<Self> {
+    pub fn from_repr(repr: FieldBytes<C>) -> CtOption<Self> {
         Scalar::<C>::from_repr(repr).and_then(Self::new)
     }
 
     /// Create a [`NonZeroScalar`] from a scalar.
-    // TODO(tarcieri): make this constant time?
-    pub fn new(scalar: Scalar<C>) -> Option<Self> {
-        if scalar.is_zero() {
-            None
-        } else {
-            Some(Self { scalar })
-        }
+    pub fn new(scalar: Scalar<C>) -> CtOption<Self> {
+        CtOption::new(Self { scalar }, !scalar.is_zero())
     }
 }
 
@@ -141,7 +138,7 @@ where
 {
     fn from(sk: &SecretKey<C>) -> NonZeroScalar<C> {
         let scalar = sk.as_scalar_bytes().to_scalar();
-        debug_assert!(!scalar.is_zero());
+        debug_assert!(!bool::from(scalar.is_zero()));
         Self { scalar }
     }
 }
@@ -166,7 +163,10 @@ where
 
     fn try_from(bytes: &[u8]) -> Result<Self> {
         if bytes.len() == C::UInt::BYTE_SIZE {
-            NonZeroScalar::from_repr(GenericArray::clone_from_slice(bytes)).ok_or(Error)
+            Option::from(NonZeroScalar::from_repr(GenericArray::clone_from_slice(
+                bytes,
+            )))
+            .ok_or(Error)
         } else {
             Err(Error)
         }