QPQ-AG/libsodium
12
0
Fork 0
mirror of https://github.com/jedisct1/libsodium.git synced 2026-08-25 08:37:13 +09:00
Code Issues Packages Projects Releases Wiki Activity

Remove S<l check.

Browse Source 
Plan is to add is_standard()/is_canonical() instead of changing the current behavior
of the verification function. Suggested by CodesInChaos.
This commit is contained in:
Frank Denis
2014-10-06 12:21:40 -07:00
parent 15889c2e64
commit cb07df046f
2 changed files with 0 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libsodium/crypto_sign/ed25519/ref10/open.c
-29
View File
@@ -9,29 +9,6 @@
#include "sc.h"
#include "utils.h"
#ifdef ED25519_PREVENT_MALLEABILITY
static int
crypto_sign_check_S_lt_l(const unsigned char *S)
{
static const unsigned char l[32] =
{ 0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58,
0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10 };
unsigned char c = 0;
unsigned char n = 1;
unsigned int i = 32;
do {
i--;
c |= ((S[i] - l[i]) >> 8) & n;
n &= ((S[i] ^ l[i]) - 1) >> 8;
} while (i != 0);
return ((int) c) - 1;
}
#endif
int
crypto_sign_verify_detached(const unsigned char *sig, const unsigned char *m,
unsigned long long mlen, const unsigned char *pk)
@@ -44,15 +21,9 @@ crypto_sign_verify_detached(const unsigned char *sig, const unsigned char *m,
ge_p3 A;
ge_p2 R;
#ifdef ED25519_PREVENT_MALLEABILITY
if (crypto_sign_check_S_lt_l(sig + 32) != 0) {
return -1;
}
#else
if (sig[63] & 224) {
return -1;
}
#endif
if (ge_frombytes_negate_vartime(&A, pk) != 0) {
return -1;
}
test/default/sign.c
-7
View File
@@ -1096,17 +1096,10 @@ int main(void)
continue;
}
add_l(sm + 32);
#ifdef ED25519_PREVENT_MALLEABILITY
if (crypto_sign_open(m, &mlen, sm, smlen, test_data[i].pk) != -1) {
printf("crypto_sign_open(): signature [%u] is malleable\n", i);
continue;
}
#else
if (crypto_sign_open(m, &mlen, sm, smlen, test_data[i].pk) != 0) {
printf("crypto_sign_open(): signature [%u] is not malleable\n", i);
continue;
}
#endif
if (memcmp(test_data[i].m, m, (size_t)mlen) != 0) {
printf("message verification failure: [%u]\n", i);
continue;