Elliptic curve point multiplication incorrect result if input X = 0

[guidovranken]

operation name: ECC_Point_Mul
ecc curve: secp256r1
A X: 0
A Y: 46263761741508638697010950048709651021688891777877937875096931459006746039284
B: 4951760157141521099596496898

modifier: {}
Module relic result:

X: 86276458647412067178347008437845892125965870927340028107831141025503900516030
Y: 86276458647412067178347008437845892125965870927340028107831141025503900516030


Module Botan result:

X: 39413481345714412313259129025515012045914827916077802016872105278265461716524
Y: 112817648962403962299127782443156973429611563676157656105969619112615985027738


Module Golang result:

X: 39413481345714412313259129025515012045914827916077802016872105278265461716524
Y: 112817648962403962299127782443156973429611563676157656105969619112615985027738

e.g. the point (A X, A Y) is multiplied by the scalar B.

[guidovranken]

In case it is relevant:

My code: https://github.com/guidovranken/cryptofuzz/blob/a51b5663232ffe2335c344f6a6862cab78e9186c/modules/relic/module.cpp#L559-L618
How I compile relic: https://github.com/guidovranken/cryptofuzz/blob/master/docs/relic.md
Linux 64 bit.

No other bugs with ec_add or ec_mul were found; just this specific case.

[dfaranha]

This should have been fixed now, the bug was introduced 12 years ago to handle a special case in an early pairing implementation and was never fixed afterwards.

[guidovranken]

It still outputs uninitialized memory, try running this code with valgrind:

#include <relic_conf.h>
#include <relic.h>

#define CF_CHECK_NE(expr, res) if ( (expr) == (res) ) { goto end; }

int main(void)
{
    const unsigned char point[65] = {0x04, 0x79, 0xBE, 0x66, 0x7E, 0xF9, 0xDC, 0xBB, 0xAC, 0x55, 0xA0, 0x62, 0x95, 0xCE, 0x87, 0x0B, 0x07, 0x02, 0x9B, 0xFC, 0xDB, 0x2D, 0xCE, 0x28, 0xD9, 0x59, 0xF2, 0x81, 0x5B, 0x16, 0xF8, 0x17, 0x98, 0xB7, 0xC5, 0x25, 0x88, 0xD9, 0x5C, 0x3B, 0x9A, 0xA2, 0x5B, 0x04, 0x03, 0xF1, 0xEE, 0xF7, 0x57, 0x02, 0xE8, 0x4B, 0xB7, 0x59, 0x7A, 0xAB, 0xE6, 0x63, 0xB8, 0x2F, 0x6F, 0x04, 0xEF, 0x27, 0x77};
    unsigned char outpoint[65];
    core_init();
    ec_t a, res;
    bn_t bn;
    bn_null(bn);
    bn_new(bn);
    /* noret */ ep_param_set(SECG_K256);
    /* noret */ ec_new(a);
    /* noret */ ec_read_bin(a, point, 65);
    /* noret */ bn_read_str(bn, "0", 1, 10);
    CF_CHECK_NE(ec_on_curve(a), 0);
    /* noret */ ec_new(res);
    ec_mul(res, a, bn);
    ec_write_bin(outpoint, 65, res, 0);
    for (size_t i = 0; i < 65; i++) {
        printf("%02X ", outpoint[i]);
    }
    printf("\n");
end:
    return 0;
}

IMHO ec_mul should throw an exception, or at least zero the output point, instead of leaving it uninitialized.

Additionally this input was found involving point addition:

  | operation name: ECC_Point_Add
-- | --
  | ecc curve: secp256r1
  | A X: 48439561293906451759052585252797914202762949526041747995844080717082404635286
  | A Y: 79657838253606452964112319029819691573475036742305299123656433055298683448842
  | B X: 48439561293906451759052585252797914202762949526041747995844080717082404635286
  | B Y: 36134250956749795798585127919587881956611106672985015071877198253568414405109
  |  
  | Module relic result:
  |  
  | X: 12651670180400286193832927958889935569805090647158332506415309155774119280640
  | Y: 0
  |  
  |  
  | Module relic result:
  |  
  | X: 12651670180400286394700183491263720012550352189803657821690683378623223693312
  | Y: 0

Two different output points for the same input suggests that uninitialized memory is at play here as well.

[dfaranha]

All of these are related to exporting the point at infinity not writing 0s to the whole array, fixed in e9948b7041c7aa9d6d368d3fedc8496020d8b48f

[guidovranken]

Great, confirmed fixed.