4c34026d12
Imported from patch attached to https://rt.openssl.org/Ticket/Display.html?id=4439. But with the extra vs $extra typo fixed. The root problem appears to be that lazy_reduction tries to use paddd instead of paddq when they believe the sum will not overflow a u32. In the final call to lazy_reduction, this is not true. svaldez and I attempted to work through the bounds, but the bounds derived from the cited paper imply paddd is always fine. Empirically in a debugger, the bounds are exceeded in the test case. I requested more comments from upstream on the bug. When upstream lands their final fix (hopefully with comments), I will update this code. In the meantime, let's stop carrying known-broken stuff. (vlazy_reduction is probably something similar, but since we don't enable that code, we haven't bothered analyzing it.) Also add the smaller of the two test cases that catch the bug. (The other uses an update pattern which isn't quite what poly1305_test does.) Change-Id: I446ed47c21f10b41a0745de96ab119a3f6fd7801 Reviewed-on: https://boringssl-review.googlesource.com/7544 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> |
||
|---|---|---|
| .. | ||
| poly1305-armv4.pl | ||
| poly1305-armv8.pl | ||
| poly1305-x86_64.pl | ||
| poly1305-x86.pl | ||