authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-08-13 04:28:51+02:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-09-23 10:15:27+02:00
logbf516019a9280993b178c887c7d5c1867048cc7f
tree02419331fbc5d9eee3425dd39629b46d232935b0
parentcacb188e3df099624158ed52be104d3d03bbbf11

std.crypto.ed25519: x=0 with the sign bit should be a decoding error

An edwards25519 point with x=0 is not expected to have the sign bit set. This is rejected later with an IdentityElement error, but technically it should be a decoding error (InvalidEncoding).

2 files changed, 7 insertions(+), 4 deletions(-)

lib/std/crypto/25519/ed25519.zig+4-4
...@@ -692,25 +692,25 @@ test "test vectors" {...@@ -692,25 +692,25 @@ test "test vectors" {
692 .msg_hex = "9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41",692 .msg_hex = "9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41",
693 .public_key_hex = "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43",693 .public_key_hex = "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43",
694 .sig_hex = "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff03be9678ac102edcd92b0210bb34d7428d12ffc5df5f37e359941266a4e35f0f",694 .sig_hex = "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff03be9678ac102edcd92b0210bb34d7428d12ffc5df5f37e359941266a4e35f0f",
695 .expected = error.IdentityElement, // 8 - non-canonical R695 .expected = error.InvalidEncoding, // 8 - non-canonical R
696 },696 },
697 Vec{697 Vec{
698 .msg_hex = "9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41",698 .msg_hex = "9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41",
699 .public_key_hex = "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43",699 .public_key_hex = "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43",
700 .sig_hex = "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffca8c5b64cd208982aa38d4936621a4775aa233aa0505711d8fdcfdaa943d4908",700 .sig_hex = "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffca8c5b64cd208982aa38d4936621a4775aa233aa0505711d8fdcfdaa943d4908",
701 .expected = error.IdentityElement, // 9 - non-canonical R701 .expected = error.InvalidEncoding, // 9 - non-canonical R
702 },702 },
703 Vec{703 Vec{
704 .msg_hex = "e96b7021eb39c1a163b6da4e3093dcd3f21387da4cc4572be588fafae23c155b",704 .msg_hex = "e96b7021eb39c1a163b6da4e3093dcd3f21387da4cc4572be588fafae23c155b",
705 .public_key_hex = "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",705 .public_key_hex = "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
706 .sig_hex = "a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04",706 .sig_hex = "a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04",
707 .expected = error.IdentityElement, // 10 - small-order A707 .expected = error.InvalidEncoding, // 10 - small-order A
708 },708 },
709 Vec{709 Vec{
710 .msg_hex = "39a591f5321bbe07fd5a23dc2f39d025d74526615746727ceefd6e82ae65c06f",710 .msg_hex = "39a591f5321bbe07fd5a23dc2f39d025d74526615746727ceefd6e82ae65c06f",
711 .public_key_hex = "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",711 .public_key_hex = "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
712 .sig_hex = "a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04",712 .sig_hex = "a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04",
713 .expected = error.IdentityElement, // 11 - small-order A713 .expected = error.InvalidEncoding, // 11 - small-order A
714 },714 },
715 };715 };
716 for (entries) |entry| {716 for (entries) |entry| {
lib/std/crypto/25519/edwards25519.zig+3
...@@ -43,6 +43,9 @@ pub const Edwards25519 = struct {...@@ -43,6 +43,9 @@ pub const Edwards25519 = struct {
43 return error.InvalidEncoding;43 return error.InvalidEncoding;
44 }44 }
45 x.cMov(x.mul(Fe.sqrtm1), 1 - @intFromBool(has_m_root));45 x.cMov(x.mul(Fe.sqrtm1), 1 - @intFromBool(has_m_root));
46 if (x.isZero() and (s[31] >> 7) != 0) {
47 return error.InvalidEncoding;
48 }
46 x.cMov(x.neg(), @intFromBool(x.isNegative()) ^ (s[31] >> 7));49 x.cMov(x.neg(), @intFromBool(x.isNegative()) ^ (s[31] >> 7));
47 const t = x.mul(y);50 const t = x.mul(y);
48 return Edwards25519{ .x = x, .y = y, .z = z, .t = t };51 return Edwards25519{ .x = x, .y = y, .z = z, .t = t };