JubJubScalar - stack overflow on random function

[vlopes11]

There is a bug on the random function for JubJubScalar. Here is how to reproduce the bug:

use dusk_jubjub::Fr;

fn main() {
    let mut rng = rand::thread_rng();

    Fr::random(&mut rng);
}

The snippet above will panic with thread 'main' has overflowed its stack

The implementation of fn random is as follows:

    /// Generate a valid Scalar choosen uniformly using user-
    /// provided rng.
    ///
    /// By `rng` we mean any Rng that implements: `Rng` + `CryptoRng`.
    pub fn random<T>(rand: &mut T) -> Fr
    where
        T: RngCore + CryptoRng,
    {
        let mut bytes = [0u8; 32];
        rand.fill_bytes(&mut bytes);
        // Ensure that the value is lower than `L`.
        bytes[31] &= 0b0000_0001;
        Fr::from_bytes(&bytes).unwrap_or_else(|| Fr::random(rand))
    }

The reason for this bug is another bug inside of subtle. This is not a proper approach since when the unwrap fails the function will recursively call itself until the stack overflow. The following code fails:

use subtle::{Choice, CtOption};

fn main() {
    let tmp = 32u64;
    let is_some = 1u8;
    let t = CtOption::new(tmp, Choice::from(is_some));
    t.unwrap_or_else(|| panic!("Fail"));
}

It should obviously work since is_some is set to 1u8. The root of the problem is the implementation of unwrap_or_else on subtle.

Subtle is beyond our scope. A secure quickfix for this is the following:

    /// Generate a valid Scalar choosen uniformly using user-
    /// provided rng.
    ///
    /// By `rng` we mean any Rng that implements: `Rng` + `CryptoRng`.
    pub fn random<T>(rand: &mut T) -> Fr
    where
        T: RngCore + CryptoRng,
    {
        let mut bytes = [0u8; 32];
        rand.fill_bytes(&mut bytes);
        // Ensure that the value is lower than `L`.
        bytes[31] &= 0b0000_0001;

        Fr::from_bytes(&bytes).unwrap_or({
            let mut bytes = [0u8; 64];
            rand.fill_bytes(&mut bytes);
            Fr::from_bytes_wide(&bytes)
        })
    }

The from_bytes_wide function will safely reduce a wide set of bytes to a JubJubScalar