A preliminary observation: The C++ standard (in contrast to the C
standard) does not explicitly prescribe one of two's complement,
one's complement, sign-magnitude for signed integer representations,
but certainly those three choices are allowed by C++.

On 11/14/2014 11:45 PM, Jeffrey Yasskin wrote:
> We could suggest that the programmers explicitly multiply by a power
> of 2 instead, but they're using the <<s at least partly to get
> constant-time operation, and relying on multiplication for this would
> depend even more on implementation details than they already are.

This seems to rely on two's complement representation for negative
numbers, which is (from the standard's perspective) a non-portable
assumption.

In my opinion, users expecting constant-time operations would be
better served with a (small) library that allows them to express their
intent, instead of misusing shifts for multiplication. For example,
the following would help (after adding a "multiplication-by-power-of-two"
function):
http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2014/n4145.html

> Separately, a related piece of code uses a signed right-shift to
> repeat the sign bit across all the bits of a number:
> https://boringssl.googlesource.com/boringssl/+/e18d821dfcc32532caeeb1a2d15090672f592ce3/crypto/internal.h#157.
> This is implementation-defined rather than undefined, so the
> programmers can probably use #if to check for the behavior they
> expect, as at
> https://github.com/teor2345/tor/blob/ced74e0144e967f838416e6af92cba65c007d89b/src/ext/curve25519_donna/curve25519-donna.c#L466

Well, that's still a bit disappointing, since you get an #error if your
compiler doesn't provide the expected semantics.

If we can identify a small set of basic operations that people want to
use, we should give them a (small) library instead of asking them to do
non-portable things.

> Is there space to improve the situation here?

Yes, but (in my opinion), it's not in the direction of changing the
core language for these purposes.

Bit-shifts are for unsigned numbers; applying them to signed numbers
is a bug, in my opinion.

Jens