diff --git a/src/libsodium/crypto_sign/ed25519/ref10/open.c b/src/libsodium/crypto_sign/ed25519/ref10/open.c index 38c48ee0..488333e9 100644 --- a/src/libsodium/crypto_sign/ed25519/ref10/open.c +++ b/src/libsodium/crypto_sign/ed25519/ref10/open.c @@ -9,29 +9,6 @@ #include "sc.h" #include "utils.h" -#ifdef ED25519_PREVENT_MALLEABILITY -static int -crypto_sign_check_S_lt_l(const unsigned char *S) -{ - static const unsigned char l[32] = - { 0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, - 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10 }; - unsigned char c = 0; - unsigned char n = 1; - unsigned int i = 32; - - do { - i--; - c |= ((S[i] - l[i]) >> 8) & n; - n &= ((S[i] ^ l[i]) - 1) >> 8; - } while (i != 0); - - return ((int) c) - 1; -} -#endif - int crypto_sign_verify_detached(const unsigned char *sig, const unsigned char *m, unsigned long long mlen, const unsigned char *pk) @@ -44,15 +21,9 @@ crypto_sign_verify_detached(const unsigned char *sig, const unsigned char *m, ge_p3 A; ge_p2 R; -#ifdef ED25519_PREVENT_MALLEABILITY - if (crypto_sign_check_S_lt_l(sig + 32) != 0) { - return -1; - } -#else if (sig[63] & 224) { return -1; } -#endif if (ge_frombytes_negate_vartime(&A, pk) != 0) { return -1; } diff --git a/test/default/sign.c b/test/default/sign.c index 1e02dc3a..8c516527 100644 --- a/test/default/sign.c +++ b/test/default/sign.c @@ -1096,17 +1096,10 @@ int main(void) continue; } add_l(sm + 32); -#ifdef ED25519_PREVENT_MALLEABILITY - if (crypto_sign_open(m, &mlen, sm, smlen, test_data[i].pk) != -1) { - printf("crypto_sign_open(): signature [%u] is malleable\n", i); - continue; - } -#else if (crypto_sign_open(m, &mlen, sm, smlen, test_data[i].pk) != 0) { printf("crypto_sign_open(): signature [%u] is not malleable\n", i); continue; } -#endif if (memcmp(test_data[i].m, m, (size_t)mlen) != 0) { printf("message verification failure: [%u]\n", i); continue;