[monero-project/monero] crypto: remove slight bias in key generation due to modulo (#4097)

stoffu commented on this pull request.

> + if (k0[n] > k1[n])
+ return false;
+ }
+ return false;
+ }
+
+ void random32_unbiased(unsigned char *bytes)
+ {
+ // l = 2^252 + 27742317777372353535851937790883648493.
+ // it fits 15 in 32 bytes
+ static const unsigned char limit[32] = { 0xe3, 0x6a, 0x67, 0x72, 0x8b, 0xce, 0x13, 0x29, 0x8f, 0x30, 0x82, 0x8c, 0x0b, 0xa4, 0x10, 0x39, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0 };
+ do
+ {
+ generate_random_bytes_thread_safe(32, bytes);
+ } while (!less32(bytes, limit)); // should be good about 15/16 of the time
+ sc_reduce32(bytes);

Ah, I finally got the idea :)
The comment initially looked mysterious to me. Maybe rephrase it to something like `15*l fits in 32 bytes`?

This post was last modified on July 6, 2018, 6:36 am