Skip to content

Commit b942b9f

Browse files
committed
Clear _gej instances after point multiplication to avoid potential leaks
Quoting sipa (see bitcoin-core#1479 (comment)): "When performing an EC multiplication A = aG for secret a, the resulting _affine_ coordinates of A are presumed to not leak information about a (ECDLP), but the same is not necessarily true for the Jacobian coordinates that come out of our multiplication algorithm." For the ECDH point multiplication result, the result in Jacobi coordinates should be cleared not only to avoid leaking the scalar, but even more so as it's a representation of the resulting shared secret.
1 parent c5299e9 commit b942b9f

File tree

4 files changed

+4
-0
lines changed

4 files changed

+4
-0
lines changed

src/modules/ecdh/main_impl.h

+1
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ int secp256k1_ecdh(const secp256k1_context* ctx, unsigned char *output, const se
6666
secp256k1_memclear(y, sizeof(y));
6767
secp256k1_scalar_clear(&s);
6868
secp256k1_ge_clear(&pt);
69+
secp256k1_gej_clear(&res);
6970

7071
return !!ret & !overflow;
7172
}

src/modules/musig/session_impl.h

+1
Original file line numberDiff line numberDiff line change
@@ -450,6 +450,7 @@ int secp256k1_musig_nonce_gen_internal(const secp256k1_context* ctx, secp256k1_m
450450
secp256k1_ge_set_gej(&nonce_pts[i], &nonce_ptj);
451451
secp256k1_declassify(ctx, &nonce_pts[i], sizeof(nonce_pts));
452452
secp256k1_scalar_clear(&k[i]);
453+
secp256k1_gej_clear(&nonce_ptj);
453454
}
454455
/* None of the nonce_pts will be infinity because k != 0 with overwhelming
455456
* probability */

src/modules/schnorrsig/main_impl.h

+1
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,7 @@ static int secp256k1_schnorrsig_sign_internal(const secp256k1_context* ctx, unsi
189189
secp256k1_scalar_clear(&k);
190190
secp256k1_scalar_clear(&sk);
191191
secp256k1_memclear(seckey, sizeof(seckey));
192+
secp256k1_gej_clear(&rj);
192193

193194
return ret;
194195
}

src/secp256k1.c

+1
Original file line numberDiff line numberDiff line change
@@ -597,6 +597,7 @@ static int secp256k1_ec_pubkey_create_helper(const secp256k1_ecmult_gen_context
597597

598598
secp256k1_ecmult_gen(ecmult_gen_ctx, &pj, seckey_scalar);
599599
secp256k1_ge_set_gej(p, &pj);
600+
secp256k1_gej_clear(&pj);
600601
return ret;
601602
}
602603

0 commit comments

Comments
 (0)