From cb07df046f19ee0d5ad600c579df97aaa4295cc3 Mon Sep 17 00:00:00 2001
From: Frank Denis <github@pureftpd.org>
Date: Mon, 6 Oct 2014 12:21:40 -0700
Subject: [PATCH] Remove S<l check. Plan is to add is_standard()/is_canonical()
 instead of changing the current behavior of the verification function.
 Suggested by CodesInChaos.

---
 .../crypto_sign/ed25519/ref10/open.c          | 29 -------------------
 test/default/sign.c                           |  7 -----
 2 files changed, 36 deletions(-)

diff --git a/src/libsodium/crypto_sign/ed25519/ref10/open.c b/src/libsodium/crypto_sign/ed25519/ref10/open.c
index 38c48ee0..488333e9 100644
--- a/src/libsodium/crypto_sign/ed25519/ref10/open.c
+++ b/src/libsodium/crypto_sign/ed25519/ref10/open.c
@@ -9,29 +9,6 @@
 #include "sc.h"
 #include "utils.h"
 
-#ifdef ED25519_PREVENT_MALLEABILITY
-static int
-crypto_sign_check_S_lt_l(const unsigned char *S)
-{
-    static const unsigned char l[32] =
-      { 0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58,
-        0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10 };
-    unsigned char c = 0;
-    unsigned char n = 1;
-    unsigned int  i = 32;
-
-    do {
-        i--;
-        c |= ((S[i] - l[i]) >> 8) & n;
-        n &= ((S[i] ^ l[i]) - 1) >> 8;
-    } while (i != 0);
-
-    return ((int) c) - 1;
-}
-#endif
-
 int
 crypto_sign_verify_detached(const unsigned char *sig, const unsigned char *m,
                             unsigned long long mlen, const unsigned char *pk)
@@ -44,15 +21,9 @@ crypto_sign_verify_detached(const unsigned char *sig, const unsigned char *m,
     ge_p3 A;
     ge_p2 R;
 
-#ifdef ED25519_PREVENT_MALLEABILITY
-    if (crypto_sign_check_S_lt_l(sig + 32) != 0) {
-        return -1;
-    }
-#else
     if (sig[63] & 224) {
         return -1;
     }
-#endif
     if (ge_frombytes_negate_vartime(&A, pk) != 0) {
         return -1;
     }
diff --git a/test/default/sign.c b/test/default/sign.c
index 1e02dc3a..8c516527 100644
--- a/test/default/sign.c
+++ b/test/default/sign.c
@@ -1096,17 +1096,10 @@ int main(void)
             continue;
         }
         add_l(sm + 32);
-#ifdef ED25519_PREVENT_MALLEABILITY
-        if (crypto_sign_open(m, &mlen, sm, smlen, test_data[i].pk) != -1) {
-            printf("crypto_sign_open(): signature [%u] is malleable\n", i);
-            continue;
-        }
-#else
         if (crypto_sign_open(m, &mlen, sm, smlen, test_data[i].pk) != 0) {
             printf("crypto_sign_open(): signature [%u] is not malleable\n", i);
             continue;
         }
-#endif
         if (memcmp(test_data[i].m, m, (size_t)mlen) != 0) {
             printf("message verification failure: [%u]\n", i);
             continue;