Dear all,

we found some counter-examples (examples where wrong answers were

returned) for field element computations in the C routines for P-521

(that is, modulo 2^521-1). The counterexamples, a C test file, a

Makefile, and a short README are attached.

The routines in question are: felem_square, felem_mul, felem_diff_128_64.

Can someone inform us whether these are in fact a couple of bugs that we

found, or did we miss something.

Best wishes,

Bo-Yin Yang

P.S.

The counterexamples are:

- for felem_square and felem_mul:

felem in = {

0x3fd9049d07fdc0ad, 0x3ece5f4000000000, 0x39c5349d6a623811,

0x3bf48f8409415499, 0x3ffdac80c8300000, 0x3ff3f3de63be6baf,

0x3fa3eff5c6db1743, 0x3dde8d0ddc21079f, 0x3e068b5ec961f8fc

};

- for felem_diff_128_64:

largefelem out = {

0,0,0,

0,0,0,

0,0,0

};

felem in = {

0x4000000000012270, 0x1000000000000000, 0x0010000000000000,

0x0400000000000000, 0x0800000000000000, 0x0020000000000000,

0x0000000040000000, 0x0002000000000000, 0x0000000400000000

};

-- B.Y.

--

openssl-users mailing list

To unsubscribe:

https://mta.openssl.org/mailman/listinfo/openssl-users