[tor-bugs] #33545 [Core Tor/Tor]: assertion failure when "all zero" client auth key provided

[Tor Bug Tracker & Wiki]

#33545: assertion failure when "all zero" client auth key provided
--------------------------+----------------------------------------
 Reporter:  mcs           |          Owner:  (none)
     Type:  defect        |         Status:  closed
 Priority:  High          |      Milestone:  Tor: 0.4.3.x-final
Component:  Core Tor/Tor  |        Version:  Tor: 0.4.4.0-alpha-dev
 Severity:  Normal        |     Resolution:  duplicate
 Keywords:  043-should    |  Actual Points:
Parent ID:                |         Points:
 Reviewer:  asn           |        Sponsor:
--------------------------+----------------------------------------

Comment (by cypherpunks):

 Replying to [comment:6 asn]:
 > Many thanks for the fix branch. The branch we merged as part of #33137
 is equivalent.

 What part of the commits to fix #33137 is equivalent to the branch in this
 ticket, exactly? They cover entirely different codepaths.

 The #33137 investigation into fixing faulty keys passed with `ADD_ONION`
 explicitly reached the conclusion that faulty keys passed to
 `ONION_CLIENT_AUTH_ADD` aren't even a problem that needs to be fixed. This
 ticket was filed to say those actually are an issue that needs to be
 fixed.

 {{{
   in the HSv3 client authorization feature we can get an x25519
   privkey from the control port through the ONION_CLIENT_AUTH_ADD command
 (in
   handle_control_onion_client_auth_add()).  However, we never convert that
 key
   to a pubkey, as it always lives in hs_client_service_authorization_t as
 a
   secret key. Also, when we actually do use that secret key in
   build_descriptor_cookie_keys() the x25519 module is responsible for
 doing the
   necessary tweaks to make it well formed (see how curve25519_donna() does
 the
   necessary bit transformations on the 'secret' key).
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/33545#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online