commit 9e43ee5b4ca3650ecd9c4ee8a1b77843b273d480 Author: Nick Mathewson nickm@torproject.org Date: Tue Aug 26 14:55:08 2014 -0400
Fix API for ed25519_ref10_open()
This is another case where DJB likes sticking the whole signature prepended to the message, and I don't think that's the hottest idea.
The unit tests still pass. --- src/common/crypto_ed25519.c | 20 ++------------------ src/ext/ed25519/ref10/ed25519_ref10.h | 4 ++-- src/ext/ed25519/ref10/open.c | 20 ++++++-------------- 3 files changed, 10 insertions(+), 34 deletions(-)
diff --git a/src/common/crypto_ed25519.c b/src/common/crypto_ed25519.c index 90a5fa9..5486c89 100644 --- a/src/common/crypto_ed25519.c +++ b/src/common/crypto_ed25519.c @@ -80,24 +80,8 @@ ed25519_checksig(const ed25519_signature_t *signature, const uint8_t *msg, size_t len, const ed25519_public_key_t *pubkey) { - uint8_t *smtmp; - uint8_t *tmp; - uint64_t tmplen; - int r; - - tor_assert(len < SIZE_T_CEILING - 64); - tmplen = len + 64; - tmp = tor_malloc(tmplen); - smtmp = tor_malloc(tmplen); - memcpy(smtmp, signature->sig, 64); - memcpy(smtmp+64, msg, len); - - r = ed25519_ref10_open(tmp, &tmplen, smtmp, tmplen, pubkey->pubkey); - - tor_free(tmp); - tor_free(smtmp); - - return r; + return + ed25519_ref10_open(signature->sig, msg, len, pubkey->pubkey) < 0 ? -1 : 0; }
/** Validate every signature among those in <b>checkable</b>, which contains diff --git a/src/ext/ed25519/ref10/ed25519_ref10.h b/src/ext/ed25519/ref10/ed25519_ref10.h index 1f7946d..bd1e461 100644 --- a/src/ext/ed25519/ref10/ed25519_ref10.h +++ b/src/ext/ed25519/ref10/ed25519_ref10.h @@ -7,8 +7,8 @@ int ed25519_ref10_seckey(unsigned char *sk); int ed25519_ref10_pubkey(unsigned char *pk,const unsigned char *sk); int ed25519_ref10_keygen(unsigned char *pk,unsigned char *sk); int ed25519_ref10_open( - unsigned char *m,uint64_t *mlen, - const unsigned char *sm,uint64_t smlen, + const unsigned char *signature, + const unsigned char *m,uint64_t mlen, const unsigned char *pk); int ed25519_ref10_sign( unsigned char *sig, diff --git a/src/ext/ed25519/ref10/open.c b/src/ext/ed25519/ref10/open.c index 2d0d55e..790f668 100644 --- a/src/ext/ed25519/ref10/open.c +++ b/src/ext/ed25519/ref10/open.c @@ -6,8 +6,8 @@ #include "sc.h"
int crypto_sign_open( - unsigned char *m,uint64_t *mlen, - const unsigned char *sm,uint64_t smlen, + const unsigned char *signature, + const unsigned char *m,uint64_t mlen, const unsigned char *pk ) { @@ -19,30 +19,22 @@ int crypto_sign_open( ge_p3 A; ge_p2 R;
- if (smlen < 64) goto badsig; - if (sm[63] & 224) goto badsig; + if (signature[63] & 224) goto badsig; if (ge_frombytes_negate_vartime(&A,pk) != 0) goto badsig;
memmove(pkcopy,pk,32); - memmove(rcopy,sm,32); - memmove(scopy,sm + 32,32); + memmove(rcopy,signature,32); + memmove(scopy,signature + 32,32);
- memmove(m,sm,smlen); - memmove(m + 32,pkcopy,32); - crypto_hash_sha512(h,m,smlen); + crypto_hash_sha512_3(h, rcopy, 32, pkcopy, 32, m, mlen); sc_reduce(h);
ge_double_scalarmult_vartime(&R,h,&A,scopy); ge_tobytes(rcheck,&R); if (crypto_verify_32(rcheck,rcopy) == 0) { - memmove(m,m + 64,smlen - 64); - memset(m + smlen - 64,0,64); - *mlen = smlen - 64; return 0; }
badsig: - *mlen = -1; - memset(m,0,smlen); return -1; }