Fix rejecting bad signatures / messages in DSA, ECDSA, ElGamal - #233
Fix rejecting bad signatures / messages in DSA, ECDSA, ElGamal#233michalz-zoom wants to merge 3 commits into
Conversation
AMarcedone
left a comment
AMarcedone
left a comment
There was a problem hiding this comment.
Changes make sense to me and match the formal algorithms descriptions.
|
|
||
| #================================================================= | ||
|
|
||
| exports.invalid_mod_inverse_returns_zero_when_gcd_is_not_one = (T, cb) -> |
There was a problem hiding this comment.
I am kinda nervous at this function returning 0 when there is no inverse. Not saying we should change it in this PR, but if I were to write this again I would throw instead.
There was a problem hiding this comment.
seems to be the bignum library doing that, maybe we should swap it to another one going forward long term. Initially I was going to monkey-patch it but that's kind of ugly. This is just a test to understand and lock in curreent behavior.
7124aa0 to
96f9726
Compare
| ret = c[0].modPow(@x,p).modInverse(p).multiply(c[1]).mod(p) | ||
| cb null, ret | ||
| if ((c[0].signum() <= 0) or (c[0].compareTo(p) >= 0)) or | ||
| ((c[1].signum() <= 0) or (c[1].compareTo(p) >= 0)) |
There was a problem hiding this comment.
@AMarcedone does this look good? encrypt returns both values mod p so in principle honest ciphertext should be in that range
3 participants
No description provided.