Refactor fe_isnonzero to fe_isnonzero_vartime

Cargo.toml

@@ -94,7 +94,6 @@ include = [
     "crypto/limbs/limbs.c",
     "crypto/limbs/limbs.h",
     "crypto/limbs/limbs.inl",
-    "crypto/mem.c",
     "crypto/perlasm/arm-xlate.pl",
     "crypto/perlasm/x86asm.pl",
     "crypto/perlasm/x86gas.pl",
@@ -113,7 +112,6 @@ include = [
     "include/ring-core/asm_base.h",
     "include/ring-core/base.h",
     "include/ring-core/check.h",
-    "include/ring-core/mem.h",
     "include/ring-core/poly1305.h",
     "include/ring-core/target.h",
     "include/ring-core/type_check.h",

build.rs

@@ -43,7 +43,6 @@ const RING_SRCS: &[(&[&str], &str)] = &[
     (&[], "crypto/fipsmodule/ec/gfp_p384.c"),
     (&[], "crypto/fipsmodule/ec/p256.c"),
     (&[], "crypto/limbs/limbs.c"),
-    (&[], "crypto/mem.c"),
     (&[], "crypto/poly1305/poly1305.c"),
 
     (&[AARCH64, ARM, X86_64, X86], "crypto/crypto.c"),
@@ -885,7 +884,6 @@ fn prefix_all_symbols(pp: char, prefix_prefix: &str, prefix: &str) -> String {
     ];
 
     static SYMBOLS_TO_PREFIX: &[&str] = &[
-        "CRYPTO_memcmp",
         "CRYPTO_poly1305_finish",
         "CRYPTO_poly1305_finish_neon",
         "CRYPTO_poly1305_init",

crypto/curve25519/curve25519.c

@@ -19,8 +19,6 @@
 //
 // The field functions are shared by Ed25519 and X25519 where possible.
 
-#include <ring-core/mem.h>
-
 #include "internal.h"
 #include "../internal.h"
 
@@ -397,14 +395,18 @@ static void fe_invert(fe *out, const fe *z) {
 
 // return 0 if f == 0
 // return 1 if f != 0
-static int fe_isnonzero(const fe_loose *f) {
+static int fe_isnonzero_vartime(const fe_loose *f) {
   fe tight;
   fe_carry(&tight, f);
   uint8_t s[32];
   fe_tobytes(s, &tight);
 
-  static const uint8_t zero[32] = {0};
-  return CRYPTO_memcmp(s, zero, sizeof(zero)) != 0;
+  for (unsigned i = 0; i < 32; i++) {
+    if (s[i] != 0) {
+      return 1;
+    }
+  }
+  return 0;
 }
 
 // return 1 if f is in {1,3,5,...,q-2}
@@ -507,9 +509,9 @@ int x25519_ge_frombytes_vartime(ge_p3 *h, const uint8_t s[32]) {
   fe_sq_tt(&vxx, &h->X);
   fe_mul_ttl(&vxx, &vxx, &v);
   fe_sub(&check, &vxx, &u);
-  if (fe_isnonzero(&check)) {
+  if (fe_isnonzero_vartime(&check)) {
     fe_add(&check, &vxx, &u);
-    if (fe_isnonzero(&check)) {
+    if (fe_isnonzero_vartime(&check)) {
       return 0;
     }
     fe_mul_ttt(&h->X, &h->X, &sqrtm1);

src/constant_time.rs

@@ -14,27 +14,20 @@
 
 //! Constant-time operations.
 
-use crate::{c, error};
+use crate::error;
 
 /// Returns `Ok(())` if `a == b` and `Err(error::Unspecified)` otherwise.
 /// The comparison of `a` and `b` is done in constant time with respect to the
 /// contents of each, but NOT in constant time with respect to the lengths of
 /// `a` and `b`.
 pub fn verify_slices_are_equal(a: &[u8], b: &[u8]) -> Result<(), error::Unspecified> {
-    if a.len() != b.len() {
-        return Err(error::Unspecified);
-    }
-    let result = unsafe { CRYPTO_memcmp(a.as_ptr(), b.as_ptr(), a.len()) };
-    match result {
-        0 => Ok(()),
-        _ => Err(error::Unspecified),
+    if a != b {
+        Err(error::Unspecified)
+    } else {
+        Ok(())
     }
 }
 
-prefixed_extern! {
-    fn CRYPTO_memcmp(a: *const u8, b: *const u8, len: c::size_t) -> c::int;
-}
-
 #[cfg(test)]
 mod tests {
     use crate::limb::LimbMask;