UInt::{ct_div_rem, ct_reduce} are not constant-time

[tarcieri]

As noted in #115, both of these functions compute values and then pass them as the rhs to UInt::shl_vartime.

• https://github.com/RustCrypto/crypto-bigint/blob/ed8d96b/src/uint/div.rs#L24
• https://github.com/RustCrypto/crypto-bigint/blob/ed8d96b/src/uint/div.rs#L63

cc @andrewwhitehead @mikelodder7

[mikelodder7]

On line

crypto-bigint/src/uint/div.rs

Line 15 in ed8d96b

/// This is variable only with respect to `rhs`.

it specifically says it’s variable wrt the divider. What is the expected output?

[mikelodder7]

Is the comment misleading

[tarcieri]

The issue is even if rhs is constant, it's still variable time with respect to self, due to this line:

crypto-bigint/src/uint/div.rs

Line 20 in ed8d96b

let mut bd = self.bits().saturating_sub(rhs.bits());

See this comment: #115 (comment)