org.bouncycastle.math.ec.test
Class ECConstantTimeMultiplierTest

java.lang.Object
  junit.framework.Assert
      junit.framework.TestCase
          org.bouncycastle.math.ec.test.ECConstantTimeMultiplierTest

All Implemented Interfaces:

junit.framework.Test

public class ECConstantTimeMultiplierTest

extends junit.framework.TestCase

Differential tests for ECConstantTimeMultiplier.

The multiplier exists to remove a timing side channel, not to compute anything new, so its output must agree exactly with the existing multipliers for every scalar. That is what is checked here, against ECAlgorithms.referenceMultiply(org.bouncycastle.math.ec.ECPoint, java.math.BigInteger) (plain double-and-add) and against whatever multiplier the curve is configured with, across every named curve - which covers the Fp custom curves, the generic Fp curves, the binary (F2m) curves, and the GLV curve secp256k1 whose endomorphism this multiplier deliberately bypasses.

The scalars are not only random: the recoding forces the scalar odd, splits it into fixed-width signed odd digits and relies on no digit being zero and on the accumulator never colliding with a table entry, so the boundary values below (1, 2, order-1, powers of two, values either side of a window boundary) are the cases most likely to break those assumptions.

Constructor Summary

ECConstantTimeMultiplierTest()

Method Summary

void	testAgainstReferenceOnAllNamedCurves()
void	testBasePoint() The base point is a legitimate input too, even though the fixed-base comb would normally be used for it - a caller cannot be assumed to know which point it holds.
void	testOutOfSubgroupPointSemantics() The subgroup precondition, pinned: the odd-forcing step computes (k + n)P in place of an even kP, which is the same point exactly when the order of P divides n.
void	testRejectsEvenOrder()
void	testRejectsScalarLargerThanOrder()
void	testSignAndInfinityHandling()

Methods inherited from class junit.framework.TestCase

countTestCases, createResult, getName, run, run, runBare, runTest, setName, setUp, tearDown, toString

Methods inherited from class junit.framework.Assert

assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

ECConstantTimeMultiplierTest

public ECConstantTimeMultiplierTest()

Method Detail

testAgainstReferenceOnAllNamedCurves

public void testAgainstReferenceOnAllNamedCurves()

testBasePoint

public void testBasePoint()

The base point is a legitimate input too, even though the fixed-base comb would normally be used for it - a caller cannot be assumed to know which point it holds.

testSignAndInfinityHandling

public void testSignAndInfinityHandling()

testOutOfSubgroupPointSemantics

public void testOutOfSubgroupPointSemantics()

The subgroup precondition, pinned: the odd-forcing step computes (k + n)P in place of an even kP, which is the same point exactly when the order of P divides n. For a point outside the order-n subgroup the result therefore differs from plain multiplication by nP on even scalars - deliberate, documented behaviour, asserted here so a change to the recoding shows up. sect163k1 (cofactor 2) supplies both an order-2 point - (0, 1), since y^2 + xy = x^3 + x^2 + 1 forces y = 1 at x = 0 - and a full-order point, G + (0, 1).

testRejectsEvenOrder

public void testRejectsEvenOrder()

testRejectsScalarLargerThanOrder

public void testRejectsScalarLargerThanOrder()