From 5a6deebd39497f9d0adea60d0fff5c0804178b94 Mon Sep 17 00:00:00 2001
From: Frank Denis <github@pureftpd.org>
Date: Fri, 20 Oct 2017 16:07:52 +0200
Subject: [PATCH] Add an argument to ed25519_small_order to optionally invert
 the sign

---
 src/libsodium/crypto_sign/ed25519/ref10/ed25519_ref10.h | 2 +-
 src/libsodium/crypto_sign/ed25519/ref10/keypair.c       | 4 ++--
 src/libsodium/crypto_sign/ed25519/ref10/open.c          | 8 +++++---
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/libsodium/crypto_sign/ed25519/ref10/ed25519_ref10.h b/src/libsodium/crypto_sign/ed25519/ref10/ed25519_ref10.h
index d35ae6fb..d8a4d70e 100644
--- a/src/libsodium/crypto_sign/ed25519/ref10/ed25519_ref10.h
+++ b/src/libsodium/crypto_sign/ed25519/ref10/ed25519_ref10.h
@@ -16,6 +16,6 @@ int _crypto_sign_ed25519_verify_detached(const unsigned char *sig,
                                          const unsigned char *pk,
                                          int prehashed);
 
-int _crypto_sign_ed25519_small_order(const unsigned char p[32]);
+int _crypto_sign_ed25519_small_order(const unsigned char p[32], unsigned char neg);
 
 #endif
diff --git a/src/libsodium/crypto_sign/ed25519/ref10/keypair.c b/src/libsodium/crypto_sign/ed25519/ref10/keypair.c
index 5ba6fd34..271ffd7c 100644
--- a/src/libsodium/crypto_sign/ed25519/ref10/keypair.c
+++ b/src/libsodium/crypto_sign/ed25519/ref10/keypair.c
@@ -18,7 +18,7 @@ crypto_sign_ed25519_scalarmult(unsigned char *q, const unsigned char *n,
     ge_p3          P;
     ge_p3          pl;
 
-    if (_crypto_sign_ed25519_small_order(p) ||
+    if (_crypto_sign_ed25519_small_order(p, 1) ||
         ge_frombytes_negate_vartime(&P, p) != 0) {
         return -1;
     }
@@ -83,7 +83,7 @@ crypto_sign_ed25519_pk_to_curve25519(unsigned char *curve25519_pk,
     fe    x;
     fe    one_minus_y;
 
-    if (_crypto_sign_ed25519_small_order(ed25519_pk) ||
+    if (_crypto_sign_ed25519_small_order(ed25519_pk, 1) ||
         ge_frombytes_negate_vartime(&A, ed25519_pk) != 0) {
         return -1;
     }
diff --git a/src/libsodium/crypto_sign/ed25519/ref10/open.c b/src/libsodium/crypto_sign/ed25519/ref10/open.c
index fa1c72d8..94c55e83 100644
--- a/src/libsodium/crypto_sign/ed25519/ref10/open.c
+++ b/src/libsodium/crypto_sign/ed25519/ref10/open.c
@@ -34,7 +34,7 @@ crypto_sign_check_S_lt_L(const unsigned char *S)
 }
 
 int
-_crypto_sign_ed25519_small_order(const unsigned char p[32])
+_crypto_sign_ed25519_small_order(const unsigned char p[32], unsigned char neg)
 {
     CRYPTO_ALIGN(16)
     static const unsigned char blacklist[][32] = {
@@ -94,11 +94,13 @@ _crypto_sign_ed25519_small_order(const unsigned char p[32])
     size_t        i, j;
     unsigned char c;
 
+    neg <<= 7;
     for (i = 0; i < sizeof blacklist / sizeof blacklist[0]; i++) {
         c = 0;
-        for (j = 0; j < 32; j++) {
+        for (j = 0; j < 31; j++) {
             c |= p[j] ^ blacklist[i][j];
         }
+        c |= p[j] ^ blacklist[i][j] ^ neg;
         if (c == 0) {
             return 1;
         }
@@ -124,7 +126,7 @@ _crypto_sign_ed25519_verify_detached(const unsigned char *sig,
 
 #ifndef ED25519_COMPAT
     if (crypto_sign_check_S_lt_L(sig + 32) != 0 ||
-        _crypto_sign_ed25519_small_order(sig) != 0) {
+        _crypto_sign_ed25519_small_order(sig, 0) != 0) {
         return -1;
     }
 #else