Use only unsigned arithmetic in constant-time operations

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

diff --git a/crypto/constant_time_locl.h b/crypto/constant_time_locl.h
index 7b339a7c317b910805686c577761abf6deeb8e9c..ccb64082fde0ffcb68577912eec5e0619f5ee364 100644 (file)
--- a/crypto/constant_time_locl.h
+++ b/crypto/constant_time_locl.h
@@ -129,17 +129,12 @@ static inline int constant_time_select_int(unsigned int mask, int a, int b);
 
 static inline unsigned int constant_time_msb(unsigned int a)
        {
-       return (unsigned int)((int)(a) >> (sizeof(int) * 8 - 1));
+       return -(a >> (sizeof(unsigned int) * 8 - 1));
        }
 
 static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
        {
-       unsigned int lt;
-       /* Case 1: msb(a) == msb(b). a < b iff the MSB of a - b is set.*/
-       lt = ~(a ^ b) & (a - b);
-       /* Case 2: msb(a) != msb(b). a < b iff the MSB of b is set. */
-       lt |= ~a & b;
-       return constant_time_msb(lt);
+       return constant_time_msb(a^((a^b)|((a-b)^b)));
        }
 
 static inline unsigned char constant_time_lt_8(unsigned int a, unsigned int b)
@@ -149,12 +144,7 @@ static inline unsigned char constant_time_lt_8(unsigned int a, unsigned int b)
 
 static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)
        {
-       unsigned int ge;
-       /* Case 1: msb(a) == msb(b). a >= b iff the MSB of a - b is not set.*/
-       ge = ~((a ^ b) | (a - b));
-       /* Case 2: msb(a) != msb(b). a >= b iff the MSB of a is set. */
-       ge |= a & ~b;
-       return constant_time_msb(ge);
+       return ~constant_time_lt(a, b);
        }
 
 static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b)