authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2025-09-17 12:09:35+02:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2025-09-17 12:09:35+02:00
log8e8a143d62b6176d94289a2a1e52295b46dfd319
treef2b6d122f76ab43c37b4eff7210b967445521da9
parent9819f53453a95aee97bc12854e6d7653b597c2b3
signaturebadge-check Signed by PGP key B5690EEEBB952194

Avoid logic where we return success in case of an error (#25251)

In ed25519.zig, we checked if a test succeeds, in which case we returned an error. This was confusing, and Andrew pointed out that Zig weights branches against errors by default.

1 files changed, 8 insertions(+), 4 deletions(-)

lib/std/crypto/25519/ed25519.zig+8-4
......@@ -175,6 +175,10 @@ pub const Ed25519 = struct {
175175 self.h.update(msg);
176176 }
177177
178 fn isIdentity(p: Curve) bool {
179 return p.x.isZero() and p.y.equivalent(p.z);
180 }
181
178182 pub const VerifyError = WeakPublicKeyError || IdentityElementError ||
179183 SignatureVerificationError;
180184
......@@ -195,9 +199,9 @@ pub const Ed25519 = struct {
195199 hram,
196200 ));
197201 const check = sb_ah.sub(self.expected_r.clearCofactor());
198 if (check.rejectIdentity()) |_| {
202 if (!isIdentity(check)) {
199203 return error.SignatureVerificationFailed;
200 } else |_| {}
204 }
201205 }
202206
203207 /// Verify that the signature is valid for the entire message using cofactorless verification.
......@@ -221,9 +225,9 @@ pub const Ed25519 = struct {
221225 hram,
222226 ));
223227 const check = sb_ah.sub(self.expected_r);
224 if (check.rejectIdentity()) |_| {
228 if (!isIdentity(check)) {
225229 return error.SignatureVerificationFailed;
226 } else |_| {}
230 }
227231 }
228232 };
229233