AGentooCat/i2p.i2p
1
0
Fork 0
forked from I2P_Developers/i2p.i2p
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Crypto: Ed25519 check for S < L as in RFC 8032

Browse Source
This commit is contained in:
zzz
2019-03-12 12:55:58 +00:00
parent 91c59dfb6b
commit d7d1dcb539
2 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
core/java/src/net/i2p/crypto/eddsa/EdDSABlinding.java
View File

@@ -21,7 +21,7 @@ public final class EdDSABlinding {
private static final byte[] ONE = Utils.hexToBytes("0100000000000000000000000000000000000000000000000000000000000000");
private static final Field FIELD = EdDSANamedCurveTable.getByName("Ed25519").getCurve().getField();
private static final BigInteger ORDER = new BigInteger("2").pow(252).add(new BigInteger("27742317777372353535851937790883648493"));
public static final BigInteger ORDER = new BigInteger("2").pow(252).add(new BigInteger("27742317777372353535851937790883648493"));
private EdDSABlinding() {}

7
core/java/src/net/i2p/crypto/eddsa/EdDSAEngine.java
View File

@@ -1,6 +1,7 @@
package net.i2p.crypto.eddsa;
import java.io.ByteArrayOutputStream;
import java.math.BigInteger;
import java.nio.ByteBuffer;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
@@ -18,6 +19,7 @@ import java.util.Arrays;
import net.i2p.crypto.eddsa.math.Curve;
import net.i2p.crypto.eddsa.math.GroupElement;
import net.i2p.crypto.eddsa.math.ScalarOps;
import net.i2p.crypto.eddsa.math.bigint.BigIntegerLittleEndianEncoding;
/**
* Signing and verification for EdDSA.
@@ -300,6 +302,11 @@ public class EdDSAEngine extends Signature {
h = key.getParams().getScalarOps().reduce(h);
byte[] Sbyte = Arrays.copyOfRange(sigBytes, b/8, b/4);
// RFC 8032
BigInteger Sbigint = (new BigIntegerLittleEndianEncoding()).toBigInteger(Sbyte);
if (Sbigint.compareTo(EdDSABlinding.ORDER) >= 0)
return false;
// R = SB - H(Rbar,Abar,M)A
GroupElement R = key.getParams().getB().doubleScalarMultiplyVariableTime(
((EdDSAPublicKey) key).getNegativeA(), h, Sbyte);