dalek-cryptography / curve25519-dalek

A pure-Rust implementation of group operations on Ristretto and Curve25519
Other
850 stars 416 forks source link

Use a variable time multiplication for the torsion check #657

Open randombit opened 1 month ago

randombit commented 1 month ago

As the group order is anyway public, there is no reason to prevent it from leaking to a side channel.

On my laptop (i7-10610U) the benchmark of is_torsion_free improves from 34 μs to 24 μs.