Fix wrapping shifts and add unbounded shifts #1160

andrewwhitehead · 2026-01-27T23:14:24Z

This PR makes a couple breaking changes: wrapping shift methods are updated to behave accordingly with core, so the shift value itself is wrapped at the capacity of the integer instead of the integer becoming zero when the shift exceeds the capacity. The new unbounded_shl/unbounded_shr methods provide support for the old behavior. The ShlVartime and ShrVartime traits also get a new method to support unbounded shifts.

The performance of constant-time shl/shr methods is improved by only performing one sub-limb shift instead of multiple.

Fixes #1151

codecov · 2026-01-27T23:18:06Z

Codecov Report

❌ Patch coverage is 98.22560% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.85%. Comparing base (77bdacd) to head (ab512c6).
⚠️ Report is 2 commits behind head on master.

Files with missing lines	Patch %	Lines
src/uint/ref_type/shl.rs	93.24%	5 Missing ⚠️
src/uint/ref_type/shr.rs	93.50%	5 Missing ⚠️
src/uint/boxed/shr.rs	95.89%	3 Missing ⚠️
src/uint/mul/karatsuba.rs	80.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1160      +/-   ##
==========================================
+ Coverage   84.49%   84.85%   +0.36%     
==========================================
  Files         181      181              
  Lines       19674    19892     +218     
==========================================
+ Hits        16624    16880     +256     
+ Misses       3050     3012      -38

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

tarcieri · 2026-02-01T16:25:49Z

src/modular/bingcd/extension.rs

+        // #[test]
+        // fn bounded_overflowing_shr() {
+        //     let res = U64::MAX.bounded_overflowing_shr::<32>(20);
+        //     assert!(bool::from(res.is_some()));
+        //     assert_eq!(res.unwrap(), U64::MAX.overflowing_shr(20).unwrap());

-            let res = U64::MAX.bounded_overflowing_shr::<32>(32);
-            assert!(bool::from(res.is_none()));
-        }
+        //     let res = U64::MAX.bounded_overflowing_shr::<32>(32);
+        //     assert!(bool::from(res.is_none()));
+        // }


Forget to uncomment this?

Oops, updated the test.

Signed-off-by: Andrew Whitehead <cywolf@gmail.com>

… UintRef Signed-off-by: Andrew Whitehead <cywolf@gmail.com>

Signed-off-by: Andrew Whitehead <cywolf@gmail.com>

tarcieri · 2026-02-01T17:27:51Z

src/primitives.rs

+/// Remainder calculation, constant time for a given divisor `d`.
+/// Based on "Faster Remainder by Direct Computation: Applications to Compilers and Software Libraries"
+/// by Daniel Lemire, Owen Kaser, and Nathan Kurz., Fig. 1.
+#[inline(never)]
+#[allow(clippy::cast_possible_truncation)]
+pub(crate) const fn u32_rem(n: u32, d: u32) -> u32 {
+    assert!(d > 0, "divisor must be nonzero");
+    let c = u64::MAX / (d as u64) + 1;


This is performing division

Yes, only between a constant and the divisor though which should be constant time for a given numerator.

I did check the assembly and it looked reasonable, the numerator only gets multiplied. The inline(never) is to help avoid optimizations.

On several architectures, division is variable-time with respect to both dividend and divisor

Yeah but that shouldn't be a problem, it only promises to be constant time for a given divisor (the number of bits in an integer, so far). This could be renamed as _vartime I suppose.

Yeah, I think it'd be fine if it were named _vartime and noted as being variable-time with respect to d.

It probably wouldn't be too hard to implement a fully constant-time version, FWIW.

Don't we already have a constant-time version in div_limb.rs?

The 32-bit implementation in div_limb is conditional on the platform right now but that could be adjusted, or this could use the word-sized implementation. This version is much simpler though.

Release notes: https://github.com/rust-random/rand_core/releases/tag/v0.10.0 Also bumps the following: - `chacha20` v0.10.0-rc.10 - `crypto-bigint` v0.7.0-rc.24 - `crypto-common` v0.2.0-rc.14 - `digest` v0.11.0-rc.10 - `ecdsa` v0.17.0-rc.15 - `elliptic-curve` v0.14.0-rc.27 - `signature` v3.0.0-rc.10 This includes `wrapping_sh*` => `unbounded_sh*` changes that preserve the original behavior of our implementation after this change: RustCrypto/crypto-bigint#1160

Release notes: https://github.com/rust-random/rand_core/releases/tag/v0.10.0 Also bumps the following: - `chacha20` v0.10.0-rc.10 - `crypto-bigint` v0.7.0-rc.24 - `crypto-common` v0.2.0-rc.14 - `digest` v0.11.0-rc.10 - `ecdsa` v0.17.0-rc.15 - `elliptic-curve` v0.14.0-rc.27 - `signature` v3.0.0-rc.10 This includes `wrapping_sh*` => `unbounded_sh*` changes that preserve the original behavior of our implementation after this change: RustCrypto/crypto-bigint#1160 This also unfortunately includes the migration to `cpubits!` as it's part of this `crypto-bigint` release.

andrewwhitehead marked this pull request as draft January 27, 2026 23:30

andrewwhitehead force-pushed the upd/wrapping-shifts branch from 07801ed to 66e9080 Compare January 28, 2026 05:41

andrewwhitehead marked this pull request as ready for review January 28, 2026 22:10

andrewwhitehead force-pushed the upd/wrapping-shifts branch 2 times, most recently from d8adb00 to 342f7f2 Compare January 29, 2026 23:01

tarcieri reviewed Feb 1, 2026

View reviewed changes

andrewwhitehead added 8 commits February 1, 2026 09:57

support unbounded shr/shl and correct wrapping shr/shl for Uint, Int

1e64673

Signed-off-by: Andrew Whitehead <cywolf@gmail.com>

support unbounded shr/shl and correct wrapping shr/shl for BoxedUint,…

cad628c

… UintRef Signed-off-by: Andrew Whitehead <cywolf@gmail.com>

fix limb shift bounds

f265f64

Signed-off-by: Andrew Whitehead <cywolf@gmail.com>

fix redundant overflowing_shr_vartime for Limb

7197915

Signed-off-by: Andrew Whitehead <cywolf@gmail.com>

cover untested vartime shift methods

0c6e81f

Signed-off-by: Andrew Whitehead <cywolf@gmail.com>

use UintRef methods for Uint bit shifts

9477045

Signed-off-by: Andrew Whitehead <cywolf@gmail.com>

improve code reuse in bit shifts; speed up BoxedUint vartime shifts

b75afde

Signed-off-by: Andrew Whitehead <cywolf@gmail.com>

update test for bounded_shr

ab512c6

Signed-off-by: Andrew Whitehead <cywolf@gmail.com>

andrewwhitehead force-pushed the upd/wrapping-shifts branch from 1208796 to ab512c6 Compare February 1, 2026 17:08

tarcieri approved these changes Feb 1, 2026

View reviewed changes

tarcieri merged commit 1128ede into RustCrypto:master Feb 1, 2026
31 checks passed

tarcieri reviewed Feb 1, 2026

View reviewed changes

tarcieri mentioned this pull request Feb 2, 2026

Bump rand_core to v0.10.0 RustCrypto/elliptic-curves#1642

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix wrapping shifts and add unbounded shifts #1160

Fix wrapping shifts and add unbounded shifts #1160

Uh oh!

andrewwhitehead commented Jan 27, 2026 •

edited

Loading

Uh oh!

codecov bot commented Jan 27, 2026 •

edited

Loading

Uh oh!

tarcieri Feb 1, 2026

Uh oh!

andrewwhitehead Feb 1, 2026

Uh oh!

Uh oh!

tarcieri Feb 1, 2026

Uh oh!

andrewwhitehead Feb 1, 2026

Uh oh!

andrewwhitehead Feb 1, 2026

Uh oh!

tarcieri Feb 1, 2026

Uh oh!

andrewwhitehead Feb 1, 2026

Uh oh!

tarcieri Feb 1, 2026

Uh oh!

fjarri Feb 1, 2026

Uh oh!

andrewwhitehead Feb 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Fix wrapping shifts and add unbounded shifts #1160

Fix wrapping shifts and add unbounded shifts #1160

Uh oh!

Conversation

andrewwhitehead commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

andrewwhitehead commented Jan 27, 2026 •

edited

Loading

codecov bot commented Jan 27, 2026 •

edited

Loading