Constructing Scalars from Bytes

[georgio]

Hello,

I'm trying to construct Scalar values using from_bytes_mod_order and I'm having a weird issue.

If I plug in this byte array:

[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 193, 109, 71, 163, 62, 105, 170, 118, 98]

I obtain a Scalar encoding:

[114, 8, 61, 210, 97, 173, 145, 239, 249, 82, 50, 46, 200, 36, 198, 130, 255, 255, 255, 255, 255, 255, 255, 192, 109, 71, 163, 62, 105, 170, 118, 2]

Whereas If I plug in this array:

[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 225, 37, 53, 12, 19, 145, 247, 75, 177, 12]

It behaves as expected, and I obtain a Scalar encoding:

[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 225, 37, 53, 12, 19, 145, 247, 75, 177, 12]

This is a code snippet which reproduces this issue:

use curve25519_dalek::Scalar;
use ibig::UBig;

fn main() {
    for i in 0u64..33 {
        for j in 0..16 {
            let mut placeholder_bytes: [u8; 32] = [0u8; 32];

            let big_num: UBig = UBig::from(i + 1).pow(j);
            let big_num_bytes = big_num.to_le_bytes();
            println!("big_num_bytes: {:?}", &big_num_bytes);

            let offset = placeholder_bytes.len() - big_num_bytes.len();
            for i in 0..big_num_bytes.len() {
                placeholder_bytes[offset + i] = big_num_bytes[i];
            }
            println!("placeholder_bytes: {:?}", &placeholder_bytes);
            // All good until here

            let scalar = Scalar::from_bytes_mod_order(placeholder_bytes);

            println!("scalar_bytes: {:?}\n\n", scalar.as_bytes());
        }
    }
}

Do you think that I'm doing something wrong?

Thanks for taking a look! :-)

[tarcieri]

I would guess but haven't confirmed that one overflows the order and the other does not. Per the function name, when an input overflows the order the scalar is computed modulo the order.

Keep in mind the bytes you are providing are interpreted as little endian.

[georgio]

Oh I think you're absolutely right. This is my mistake, the zeroes should be on the other side.

Thanks for checking!!