fix: harden Paillier validation, fix buf_t aliasing, and add bn256_t … (#103)

- Fix critical use-after-free in buf_t::operator=(mem_t) and operator+=(mem_t) where a mem_t view aliasing the destination buffer would read zeroed/freed memory after the buffer was destroyed during reassignment.
- Harden Paillier create_pub to validate modulus (odd, >1, within bit_size) and return error_t instead of void, preventing acceptance of malicious moduli from counterparties.
- Enforce upper-bound check on Paillier modulus size in ECDSA 2PC keygen and refresh to prevent potential buffer overflows in constant-time decryption.
- Fix out-of-bounds write in HD key derivation by resizing derived_keys inside derive_keys() rather than relying on caller pre-allocation.
- Add bn256_t: fixed-width 256-bit modular arithmetic with constant-time Barrett reduction, Montgomery multiplication, and x86_64 MULX/ADX assembly. Replaces the old uint256_t from extended_uint.cpp.
- Fix const-correctness in secp256k1 point conversion to avoid mutating input Jacobian coordinates through cast-away-const UB.
- Add vartime_scope_t to paillier_t::verify_cipher for correct side-channel annotation on public ciphertext validation.
- Add bits_t::ref_t copy assignment operator for correct value semantics.
- Fix static initialization order for test channel fuzzing DRBG.

Author: hsiuhsiu

include-internal/cbmpc/internal/crypto/base_bn.h

@@ -17,6 +17,21 @@ struct bignum_st {
   int flags;
 };
 
+struct bn_mont_ctx_st {
+#if OPENSSL_VERSION_NUMBER < 0x30600000L
+  int ri; /* number of bits in R */
+#endif
+  BIGNUM RR;      /* used to convert to montgomery form,
+                     possibly zero-padded */
+  BIGNUM N;       /* The modulus */
+  BIGNUM Ni;      /* R*(1/R mod N) - N*Ni = 1 (Ni is only
+                   * stored for bignum algorithm) */
+  BN_ULONG n0[2]; /* least significant word(s) of Ni; (type
+                   * changed with 0.9.9, was "BN_ULONG n0;"
+                   * before) */
+  int flags;
+};
+
 namespace coinbase::crypto {
 
 constexpr int div_ceil(int a, int b) { return (a + b - 1) / b; }
@@ -40,6 +55,7 @@ class bn_t {
   friend class crypto::paillier_t;
   friend class crypto::ecdsa_signature_t;
   friend class montgomery_t;
+  friend class bn256_t;
   friend std::ostream& operator<<(std::ostream& os, const bn_t& obj);
 
  public:
@@ -215,6 +231,8 @@ class bn_t {
   for (coinbase::crypto::bn_t::set_modulo(n); coinbase::crypto::bn_t::check_modulo(n); \
        coinbase::crypto::bn_t::reset_modulo(n))
 
+const mod_t* thread_local_storage_mod();
+
 bn_t operator+(const bn_t& b1, const bn_t& b2);
 bn_t operator-(const bn_t& b1, const bn_t& b2);
 bn_t operator*(const bn_t& b1, const bn_t& b2);

include-internal/cbmpc/internal/crypto/base_bn256.h

@@ -0,0 +1,147 @@
+#pragma once
+#include "base_bn.h"
+
+using uint128_t = unsigned __int128;
+
+namespace coinbase::crypto {
+
+#ifdef __x86_64__
+bool support_x64_mulx();
+#endif
+
+inline uint64_t addx(uint64_t x, uint64_t y, uint64_t& carry) {
+#ifdef __x86_64__
+  unsigned long long z;
+  carry = _addcarry_u64(uint8_t(carry), x, y, &z);
+  return z;
+#else
+#if __has_builtin(__builtin_addcl)
+  return __builtin_addcl(x, y, carry, (unsigned long int*)&carry);
+#else
+  auto r = uint128_t(x) + y + carry;
+  carry = uint64_t(r >> 64);
+  return uint64_t(r);
+#endif
+#endif
+}
+
+inline uint64_t subx(uint64_t x, uint64_t y, uint64_t& borrow) {
+#ifdef __x86_64__
+  unsigned long long z;
+  borrow = _subborrow_u64(uint8_t(borrow), x, y, &z);
+  return z;
+#else
+#if __has_builtin(__builtin_subcl)
+  return __builtin_subcl(x, y, borrow, (unsigned long int*)&borrow);
+#else
+  auto r = uint128_t(x) - y - borrow;
+  borrow = uint64_t(r >> 64) & 1;
+  return uint64_t(r);
+#endif
+#endif
+}
+
+struct alignas(32) uint256_t {
+  uint64_t w0, w1, w2, w3;
+  static uint256_t from_hex(const std::string& hex) { return from_bn(bn_t::from_hex(hex.c_str())); }
+  static uint256_t from_str(const std::string& str) { return from_bn(bn_t::from_string(str.c_str())); }
+
+  void to_bin(byte_ptr bin) const;
+  buf_t to_bin() const;
+  static uint256_t from_bin(mem_t bin);
+  void to_bin_le(byte_ptr bin) const;
+  buf_t to_bin_le() const;
+  static uint256_t from_bin_le(mem_t bin);
+  bn_t to_bn() const;
+  static uint256_t from_bn(const bn_t& bn);
+
+  bool is_zero() const;
+  bool is_odd() const;
+  bool operator==(const uint256_t& b) const;
+  bool operator!=(const uint256_t& b) const;
+  void cnd_assign(bool flag, const uint256_t& b);
+  uint64_t mul_add_regular(const uint256_t& a, uint64_t b);
+  uint64_t div_by_two();
+  void inv_mod(const uint256_t& x, const uint256_t& m);
+
+  static void mul_noasm(uint64_t r[8], const uint256_t& a, const uint256_t& b);
+  static void mul(uint64_t r[8], const uint256_t& a, const uint256_t& b);
+  static void sqr_noasm(uint64_t r[8], const uint256_t& a);
+  static void sqr(uint64_t r[8], const uint256_t& a);
+
+  static uint256_t get_mont_rr(const uint256_t& mod);
+  static uint256_t make(uint64_t w0, uint64_t w1 = 0, uint64_t w2 = 0, uint64_t w3 = 0);
+
+ private:
+  uint64_t add_raw(const uint256_t& a, const uint256_t& b);
+  uint64_t sub_raw(const uint256_t& a, const uint256_t& b);
+  uint64_t cnd_add_raw(bool flag, const uint256_t& a);
+  uint64_t cnd_sub_raw(bool flag, const uint256_t& a);
+  uint64_t cnd_neg_raw(bool flag);
+  static void cnd_swap(bool flag, uint256_t& a, uint256_t& b);
+};
+
+struct uint320_t {
+  uint64_t w0, w1, w2, w3, w4;
+  void from_bn(const bn_t& bn);
+  static uint320_t get_barrett_mu(const uint256_t& mod);
+};
+
+class alignas(32) bn256_t {
+ public:
+  bn256_t();
+  ~bn256_t();
+  bn256_t(const bn256_t& x);
+  bn256_t(const bn_t& x);
+  bn256_t(uint64_t x);
+
+  bn256_t& operator=(const bn256_t& x);
+  bn256_t& operator=(const bn_t& x);
+  bn256_t& operator=(uint64_t x);
+  operator bn_t() const;
+
+  bool operator==(uint64_t x) const;
+  bool operator!=(uint64_t x) const;
+
+  bool operator==(const bn256_t& b) const;
+  bool operator!=(const bn256_t& b) const;
+
+  bn256_t operator+(const bn256_t& b) const;
+  bn256_t operator-(const bn256_t& b) const;
+  bn256_t operator*(const bn256_t& b) const;
+  bn256_t operator/(const bn256_t& b) const;
+
+  bn256_t& operator+=(const bn256_t& b);
+  bn256_t& operator-=(const bn256_t& b);
+  bn256_t& operator*=(const bn256_t& b);
+  bn256_t& operator/=(const bn256_t& b);
+
+  bn256_t operator-() const;
+  bn256_t inv_mod(const mod_t& q) const;
+
+  void to_bin(byte_ptr m) const;
+  buf_t to_bin() const;
+  static bn256_t from_bin(mem_t m);
+  void convert(coinbase::converter_t& c);
+  static bn256_t rand(const mod_t& q);
+  int get_bit(int b) const;
+
+  bn256_t to_mont() const;
+  bn256_t from_mont() const;
+  static bn256_t mont_mul(const bn256_t& a, const bn256_t& b);
+
+  static void mul_add_no_reduce(uint64_t r[8], const bn256_t& a, const bn256_t& b);
+  static void add_no_reduce(uint64_t r[8], const bn256_t& a);
+  static bn256_t reduce(uint64_t r[8]);
+  static bn256_t two_to_pow(int n);
+
+ private:
+  uint64_t w0, w1, w2, w3;
+  void barrett_reduce(uint64_t x[8], const uint64_t* m, const uint64_t* mu);
+  void mont_mul(const bn256_t& a, const bn256_t& b, const uint64_t* m, uint64_t mont_prime);
+  void mont_reduce(uint64_t u[8], const uint64_t* m, uint64_t mont_prime);
+};
+
+}  // namespace coinbase::crypto
+
+using coinbase::crypto::bn256_t;

include-internal/cbmpc/internal/crypto/base_mod.h

@@ -32,6 +32,7 @@ class mod_t {
   mod_t(const bn_t& m, bool multiplicative_dense = true) : multiplicative_dense(multiplicative_dense) { init(m); }
 
   void convert(coinbase::converter_t&);
+  static bool is_valid_modulus(const bn_t& m);
 
   // clang-format off
   bn_t add(const bn_t& a, const bn_t& b) const { bn_t r; _add(r, a, b); return r; }
@@ -94,6 +95,7 @@ class mod_t {
 
   BN_MONT_CTX* get_mont_ctx() const { return mont; }
   const bn_t& value() const { return m; }
+  const bn_t& get_barrett_mu() const { return mu; }
 
  private:
   bn_t m;

include-internal/cbmpc/internal/crypto/base_paillier.h

@@ -35,7 +35,8 @@ class paillier_t {
    */
   void generate();
   void create_prv(const bn_t& N, const bn_t& p, const bn_t& q);
-  void create_pub(const bn_t& N);
+  // Returns an error instead of asserting when rebuilding a public key from externally supplied material.
+  error_t create_pub(const bn_t& N);
 
   /**
    * @specs:
@@ -64,6 +65,8 @@ class paillier_t {
 
   bn_t get_cipher_randomness(const bn_t& plain, const bn_t& cipher) const;
 
+  // Private-key deserialization is intended for trusted local state only; callers must not feed it untrusted
+  // private-key material unless they validate it before use.
   void convert(coinbase::converter_t& converter);
 
   bool has_private_key() const { return has_private; }

include-internal/cbmpc/internal/crypto/ro.h

@@ -2,6 +2,10 @@
 
 #include <cbmpc/internal/crypto/base.h>
 
+namespace coinbase::crypto {
+class bn256_t;
+}
+
 namespace coinbase::crypto::ro {  // random oracle
 struct hmac_state_t {
   crypto::hmac_sha256_t hmac;
@@ -114,6 +118,7 @@ class hash_numbers_t : public hmac_state_t {
     return *this;
   }
   std::vector<bn_t> mod(const mod_t& q);
+  std::vector<bn256_t> mod256(const mod_t& p);
 
  private:
   int l;

include/cbmpc/core/buf.h

@@ -266,6 +266,10 @@ class bits_t {
       set(value);
       return *this;
     }
+    ref_t& operator=(const ref_t& src) noexcept {
+      set(src.get());
+      return *this;
+    }
     operator bool() const { return get(); }
 
    private:

src/cbmpc/core/CMakeLists.txt

@@ -12,5 +12,4 @@ target_sources(cbmpc_core PRIVATE
   convert.cpp
   error.cpp
   strext.cpp
-  extended_uint.cpp
 )

src/cbmpc/core/buf.cpp

@@ -90,14 +90,12 @@ int buf_t::size() const { return s; }
 bool buf_t::empty() const { return s == 0; }
 
 buf_t& buf_t::operator=(mem_t src) {
-  if (s != src.size || data() != src.data) {
-    free();
+  if (s == src.size && data() == src.data) return *this;
 
-    if (src.size <= short_size)
-      assign_short(src.data, src.size);
-    else
-      assign_long(src.data, src.size);
-  }
+  // `mem_t` is a view and may alias this buffer (for example `buf = buf.take(n)`),
+  // so copy it before zeroizing or reallocating the current storage.
+  buf_t tmp(src);
+  *this = std::move(tmp);
   return *this;
 }
 
@@ -261,9 +259,11 @@ buf_t operator+(mem_t src1, mem_t src2) {
 buf_t& buf_t::operator+=(mem_t src) {
   cb_assert(src.size >= 0);
   cb_assert(s <= INT_MAX - src.size);  // overflow check
+  // `mem_t` may point into this buffer, and resize() can zeroize/reallocate it.
+  buf_t tmp(src);
   int old_size = s;
-  byte_ptr new_ptr = resize(old_size + src.size);
-  memmove(new_ptr + old_size, src.data, src.size);
+  byte_ptr new_ptr = resize(old_size + tmp.size());
+  memmove(new_ptr + old_size, tmp.data(), tmp.size());
   return *this;
 }
 

src/cbmpc/core/extended_uint.cpp

@@ -8,6 +8,7 @@ target_sources(cbmpc_crypto  PRIVATE
 
   base.cpp
   base_bn.cpp
+  base_bn256.cpp
   base_mod.cpp
   base_ec_core.cpp
   base_ecc.cpp