Changeset d7d1dcb5

Timestamp:

Mar 12, 2019 12:55:58 PM (23 months ago)

Author:

zzz <zzz@…>

Branches:

master

Children:

1f861c1

Parents:

91c59df

Message:

Crypto: Ed25519 check for S < L as in RFC 8032

Location:

core/java/src/net/i2p/crypto/eddsa

Files:

• EdDSABlinding.java (modified) (1 diff)
• EdDSAEngine.java (modified) (3 diffs)

core/java/src/net/i2p/crypto/eddsa/EdDSABlinding.java

@@ -22 +22 @@
     private static final byte[] ONE = Utils.hexToBytes("0100000000000000000000000000000000000000000000000000000000000000");
     private static final Field FIELD = EdDSANamedCurveTable.getByName("Ed25519").getCurve().getField();
-    private static final BigInteger ORDER = new BigInteger("2").pow(252).add(new BigInteger("27742317777372353535851937790883648493"));
+    public static final BigInteger ORDER = new BigInteger("2").pow(252).add(new BigInteger("27742317777372353535851937790883648493"));
 
     private EdDSABlinding() {}

core/java/src/net/i2p/crypto/eddsa/EdDSAEngine.java

@@ -2 +2 @@
 
 import java.io.ByteArrayOutputStream;
+import java.math.BigInteger;
 import java.nio.ByteBuffer;
 import java.security.InvalidAlgorithmParameterException;
@@ -19 +20 @@
 import net.i2p.crypto.eddsa.math.GroupElement;
 import net.i2p.crypto.eddsa.math.ScalarOps;
+import net.i2p.crypto.eddsa.math.bigint.BigIntegerLittleEndianEncoding;
 
 /**
@@ -301 +303 @@
 
         byte[] Sbyte = Arrays.copyOfRange(sigBytes, b/8, b/4);
+        // RFC 8032
+        BigInteger Sbigint = (new BigIntegerLittleEndianEncoding()).toBigInteger(Sbyte);
+        if (Sbigint.compareTo(EdDSABlinding.ORDER) >= 0)
+            return false;
+
         // R = SB - H(Rbar,Abar,M)A
         GroupElement R = key.getParams().getB().doubleScalarMultiplyVariableTime(