authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-07-14 10:41:10+02:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-09-24 20:07:01+02:00
logc157ae2957e317afd2f5d9095e1450abbd5f1ef9
treed2a8e3ab089b43da51e45c8d1b6a82a59462d61e
parentc34e2a6b884cb30ac4466efbe961584b62730c8f

crypto.x25519: recoverPublicKey and generateDeterministic cannot fail

This performs a scalar multiplication of the base point by a clamped scalar (a multiple of 8, so we end up in the prime order group), so these functions cannot return an error. Fixes #36154

2 files changed, 9 insertions(+), 15 deletions(-)

lib/std/crypto/25519/x25519.zig+8-14
...@@ -32,24 +32,18 @@ pub const X25519 = struct {...@@ -32,24 +32,18 @@ pub const X25519 = struct {
32 /// Deterministically derive a key pair from a cryptograpically secure secret seed.32 /// Deterministically derive a key pair from a cryptograpically secure secret seed.
33 ///33 ///
34 /// Except in tests, applications should generally call `generate()` instead of this function.34 /// Except in tests, applications should generally call `generate()` instead of this function.
35 pub fn generateDeterministic(seed: [seed_length]u8) IdentityElementError!KeyPair {35 pub fn generateDeterministic(seed: [seed_length]u8) KeyPair {
36 const kp = KeyPair{36 return .{
37 .public_key = try X25519.recoverPublicKey(seed),37 .public_key = X25519.recoverPublicKey(seed),
38 .secret_key = seed,38 .secret_key = seed,
39 };39 };
40 return kp;
41 }40 }
4241
43 /// Generate a new, random key pair.42 /// Generate a new, random key pair.
44 pub fn generate(io: std.Io) KeyPair {43 pub fn generate(io: std.Io) KeyPair {
45 var random_seed: [seed_length]u8 = undefined;44 var random_seed: [seed_length]u8 = undefined;
46 while (true) {45 io.random(&random_seed);
47 io.random(&random_seed);46 return generateDeterministic(random_seed);
48 return generateDeterministic(random_seed) catch {
49 @branchHint(.unlikely);
50 continue;
51 };
52 }
53 }47 }
5448
55 /// Create a key pair from an Ed25519 key pair49 /// Create a key pair from an Ed25519 key pair
...@@ -68,8 +62,8 @@ pub const X25519 = struct {...@@ -68,8 +62,8 @@ pub const X25519 = struct {
68 };62 };
6963
70 /// Compute the public key for a given private key.64 /// Compute the public key for a given private key.
71 pub fn recoverPublicKey(secret_key: [secret_length]u8) IdentityElementError![public_length]u8 {65 pub fn recoverPublicKey(secret_key: [secret_length]u8) [public_length]u8 {
72 const q = try Curve.basePoint.clampedMul(secret_key);66 const q = Curve.basePoint.clampedMul(secret_key) catch unreachable;
73 return q.toBytes();67 return q.toBytes();
74 }68 }
7569
...@@ -96,7 +90,7 @@ test "public key calculation from secret key" {...@@ -96,7 +90,7 @@ test "public key calculation from secret key" {
96 var pk_expected: [32]u8 = undefined;90 var pk_expected: [32]u8 = undefined;
97 _ = try fmt.hexToBytes(sk[0..], "8052030376d47112be7f73ed7a019293dd12ad910b654455798b4667d73de166");91 _ = try fmt.hexToBytes(sk[0..], "8052030376d47112be7f73ed7a019293dd12ad910b654455798b4667d73de166");
98 _ = try fmt.hexToBytes(pk_expected[0..], "f1814f0e8ff1043d8a44d25babff3cedcae6c22c3edaa48f857ae70de2baae50");92 _ = try fmt.hexToBytes(pk_expected[0..], "f1814f0e8ff1043d8a44d25babff3cedcae6c22c3edaa48f857ae70de2baae50");
99 const pk_calculated = try X25519.recoverPublicKey(sk);93 const pk_calculated = X25519.recoverPublicKey(sk);
100 try std.testing.expectEqual(pk_calculated, pk_expected);94 try std.testing.expectEqual(pk_calculated, pk_expected);
101}95}
10296
lib/std/crypto/tls/Client.zig+1-1
...@@ -1370,7 +1370,7 @@ const KeyShare = struct {...@@ -1370,7 +1370,7 @@ const KeyShare = struct {
1370 .ml_kem768_kp = try .generateDeterministic(seed[0..64].*),1370 .ml_kem768_kp = try .generateDeterministic(seed[0..64].*),
1371 .secp256r1_kp = try .generateDeterministic(seed[64..96].*),1371 .secp256r1_kp = try .generateDeterministic(seed[64..96].*),
1372 .secp384r1_kp = try .generateDeterministic(seed[96..144].*),1372 .secp384r1_kp = try .generateDeterministic(seed[96..144].*),
1373 .x25519_kp = try .generateDeterministic(seed[144..176].*),1373 .x25519_kp = .generateDeterministic(seed[144..176].*),
1374 .sk_buf = undefined,1374 .sk_buf = undefined,
1375 .sk_len = 0,1375 .sk_len = 0,
1376 };1376 };