constant time/side-channel improvements

Author: dghgit

core/src/main/java/org/bouncycastle/pqc/crypto/bike/BIKEEngine.java

@@ -212,7 +212,7 @@ public void decaps(byte[] k, byte[] h0, byte[] h1, byte[] sigma, byte[] c0, byte
 
         // 3. Compute K
         byte[] wlist = functionH(mPrime);
-        if (Arrays.areEqual(ePrimeBytes, 0, R2_BYTE, wlist, 0, R2_BYTE))
+        if (Arrays.constantTimeAreEqual(R2_BYTE, ePrimeBytes, 0, wlist, 0))
         {
             functionK(mPrime, c0, c1, k);
         }

core/src/main/java/org/bouncycastle/pqc/crypto/ntruplus/NTRUPlusEngine.java

@@ -930,13 +930,18 @@ public void crypto_kem_dec(byte[] ss, int ssPos, byte[] ct, int ctPos, byte[] sk
         fail |= verify(buf1, buf2, polyBytes);
 
         // Copy shared secret, zeroing on failure
-        if (fail != 0)
-        {
-            Arrays.fill(ss, (byte)0);
-        }
-        else
+        cmov(ss, buf3, ssPos, SSBytes, fail);
+    }
+
+    /* b = 0 means mov, b = 1 means don't mov*/
+    static void cmov(byte[] r, byte[] x, int x_offset, int len, int b)
+    {
+        int i;
+
+        b = (b - 1) & 0xff;
+        for (i = 0; i < len; i++)
         {
-            System.arraycopy(buf3, 0, ss, ssPos, SSBytes);
+            r[i] ^= b & (x[i + x_offset] ^ r[i]);
         }
     }
 }

core/src/main/java/org/bouncycastle/pqc/crypto/ntruprime/NTRULPRimeKEMExtractor.java

@@ -150,7 +150,7 @@ public byte[] extractSecret(byte[] encapsulation)
          * Match Ciphertext ct with input encapsulation
          * Update encR accordingly
          */
-        int mask = (Arrays.areEqual(encapsulation, ct)) ? 0 : -1;
+        int mask = (Arrays.constantTimeAreEqual(encapsulation, ct)) ? 0 : -1;
 
         /*
          * Update encR with Ciphertext diff mask

core/src/main/java/org/bouncycastle/pqc/crypto/ntruprime/SNTRUPrimeKEMExtractor.java

@@ -125,7 +125,7 @@ public byte[] extractSecret(byte[] encapsulation)
          * Match Ciphertext ct with input encapsulation
          * Update encR accordingly
          */
-        int mask = (Arrays.areEqual(encapsulation, ct)) ? 0 : -1;
+        int mask = (Arrays.constantTimeAreEqual(encapsulation, ct)) ? 0 : -1;
 
         /*
          * Update encR with Ciphertext diff mask