From 038e4114e9d1e1dfc39c380543e9949bd4c828ee Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Thu, 22 Jul 2021 00:41:50 +0200 Subject: [PATCH] fe25519_reduce64: handle the top bit This is only for code clarity and for people copy/pasting that private code to use it in a different context. The top 128 bits are always zero. --- src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c index 96200803..9e0825d1 100644 --- a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c +++ b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c @@ -2720,7 +2720,7 @@ fe25519_reduce64(fe25519 fe_f, const unsigned char h[64]) gl[31] &= 0x7f; fe25519_frombytes(fe_f, fl); fe25519_frombytes(fe_g, gl); - fe_f[0] += (h[31] >> 7) * 19; + fe_f[0] += (h[31] >> 7) * 19 + (h[63] >> 7) * 722; for (i = 0; i < sizeof (fe25519) / sizeof fe_f[0]; i++) { fe_f[i] += 38 * fe_g[i]; }