On Thu, Jul 03, 2025 at 03:14:52PM +0200, Jason A. Donenfeld wrote: > Hi, > > On Mon, Jun 30, 2025 at 09:39:30PM +0800, Gu Bowen wrote: > > To reintroduce the sm2 algorithm, the patch set did the following: > > - Reintroduce the mpi library based on libgcrypt. > > - Reintroduce ec implementation to MPI library. > > - Rework sm2 algorithm. > > - Support verification of X.509 certificates. > > > > Gu Bowen (4): > > Revert "Revert "lib/mpi: Extend the MPI library"" > > Revert "Revert "lib/mpi: Introduce ec implementation to MPI library"" > > crypto/sm2: Rework sm2 alg with sig_alg backend > > crypto/sm2: support SM2-with-SM3 verification of X.509 certificates > > I am less than enthusiastic about this. Firstly, I'm kind of biased > against the whole "national flag algorithms" thing. But I don't know how > much weight that argument will have here. More importantly, however, > implementing this atop MPI sounds very bad. The more MPI we can get rid > of, the better. > > Is MPI constant time? Usually the good way to implement EC algorithms > like this is to very carefully work out constant time (and fast!) field > arithmetic routines, verify their correctness, and then implement your > ECC atop that. At this point, there's *lots* of work out there on doing > fast verified ECC and a bunch of different frameworks for producing good > implementations. There are also other implementations out there you > could look at that people have presumably studied a lot. This is old > news. (In 3 minutes of scrolling around, I noticed that > count_leading_zeros() on a value is used as a loop index, for example. > Maybe fine, maybe not, I dunno; this stuff requires analysis.) > > On the other hand, maybe you don't care because you only implement > verification, not signing, so all info is public? If so, the fact that > you don't care about CT should probably be made pretty visible. But > either way, you should still be concerned with having an actually good & > correct implementation of which you feel strongly about the correctness. > > Secondly, the MPI stuff you're proposing here adds a 25519 and 448 > implementation, and support for weierstrauss, montgomery, and edwards, > and... surely you don't need all of this for SM-2. Why add all this > unused code? Presumably because you don't really understand or "own" all > of the code that you're proposing to add. And that gives me a lot of > hesitation, because somebody is going to have to maintain this, and if > the person sending patches with it isn't fully on top of it, we're not > off to a good start. > > Lastly, just to nip in the bud the argument, "but weierstrauss is all > the same, so why not just have one library to do all possible > weierstrauss curves?" -- the fact that this series reintroduces the > removed "generic EC library" indicates there's actually not another user > of it, even before we get into questions of whether it's a good idea. I went looking for reference implementations and came across this "GmSSL" project and located: https://github.com/guanzhi/GmSSL/blob/master/src/sm2_sign.c#L271 which uses some routines from https://github.com/guanzhi/GmSSL/blob/master/src/sm2_z256.c I have no idea what the deal actually is here -- is this any good? has anybody looked at it? is it a random github? -- but it certainly _resembles_ something more comfortable than the MPI code. Who knows, it could be terrible, but you get the idea. Jason
