zeekay dc8a5e958a paillier: clone before saferith.Nat.Cmp in EncWithNonce ...

saferith.Nat.Cmp mutates limb storage on both sides (resizedLimbs
zero-fills the expanded slice and writes a mask) even on the
comparison-only path. Two parties sharing the same PublicKey can
race when they both encrypt concurrently and both reach the
range-check at the top of EncWithNonce. mAbs aliases m's internals
for small enough m, so we clone defensively into a per-call scratch
Nat before the Cmp.

nHalf is already a private clone of pk.nNat (Rsh on the local copy),
so it stays. Per CGGMP21 round-trip race-detector findings in the
2026-05-31 audit.

2026-06-01 00:08:17 -07:00

..

ciphertext_test.go

fix: resolve go vet and formatting issues

2025-08-05 17:59:18 -05:00

ciphertext.go

Update threshold signatures import

2025-08-02 15:47:09 -05:00

public.go

paillier: clone before saferith.Nat.Cmp in EncWithNonce

2026-06-01 00:08:17 -07:00

secret.go

chore: remove all remaining TODOs from production code

2026-03-02 23:59:00 -08:00