authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-08-13 04:28:51+02:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-09-23 10:15:27+02:00
logbf516019a9280993b178c887c7d5c1867048cc7f
tree02419331fbc5d9eee3425dd39629b46d232935b0
parentcacb188e3df099624158ed52be104d3d03bbbf11

std.crypto.ed25519: x=0 with the sign bit should be a decoding error

An edwards25519 point with x=0 is not expected to have the sign bit set. This is rejected later with an IdentityElement error, but technically it should be a decoding error (InvalidEncoding).

2 files changed, 7 insertions(+), 4 deletions(-)

lib/std/crypto/25519/ed25519.zig+4-4
......@@ -692,25 +692,25 @@ test "test vectors" {
692692 .msg_hex = "9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41",
693693 .public_key_hex = "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43",
694694 .sig_hex = "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff03be9678ac102edcd92b0210bb34d7428d12ffc5df5f37e359941266a4e35f0f",
695 .expected = error.IdentityElement, // 8 - non-canonical R
695 .expected = error.InvalidEncoding, // 8 - non-canonical R
696696 },
697697 Vec{
698698 .msg_hex = "9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41",
699699 .public_key_hex = "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43",
700700 .sig_hex = "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffca8c5b64cd208982aa38d4936621a4775aa233aa0505711d8fdcfdaa943d4908",
701 .expected = error.IdentityElement, // 9 - non-canonical R
701 .expected = error.InvalidEncoding, // 9 - non-canonical R
702702 },
703703 Vec{
704704 .msg_hex = "e96b7021eb39c1a163b6da4e3093dcd3f21387da4cc4572be588fafae23c155b",
705705 .public_key_hex = "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
706706 .sig_hex = "a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04",
707 .expected = error.IdentityElement, // 10 - small-order A
707 .expected = error.InvalidEncoding, // 10 - small-order A
708708 },
709709 Vec{
710710 .msg_hex = "39a591f5321bbe07fd5a23dc2f39d025d74526615746727ceefd6e82ae65c06f",
711711 .public_key_hex = "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
712712 .sig_hex = "a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04",
713 .expected = error.IdentityElement, // 11 - small-order A
713 .expected = error.InvalidEncoding, // 11 - small-order A
714714 },
715715 };
716716 for (entries) |entry| {
lib/std/crypto/25519/edwards25519.zig+3
......@@ -43,6 +43,9 @@ pub const Edwards25519 = struct {
4343 return error.InvalidEncoding;
4444 }
4545 x.cMov(x.mul(Fe.sqrtm1), 1 - @intFromBool(has_m_root));
46 if (x.isZero() and (s[31] >> 7) != 0) {
47 return error.InvalidEncoding;
48 }
4649 x.cMov(x.neg(), @intFromBool(x.isNegative()) ^ (s[31] >> 7));
4750 const t = x.mul(y);
4851 return Edwards25519{ .x = x, .y = y, .z = z, .t = t };