std.crypto.ed25519 incremental signatures: hash the fallback noise (#13643)
If the noise parameter was null, we didn't use any noise at all.
We unconditionally generated random noise (`noise2`) but didn't use it.
Spotted by @cryptocode, thanks!
1 files changed, 1 insertions(+), 0 deletions(-)
lib
lib/std/crypto/25519/ed25519.zig+1
| ... | ... | @@ -318,6 +318,7 @@ pub const Ed25519 = struct { |
| 318 | 318 | h.update(&scalar_and_prefix.prefix); |
| 319 | 319 | var noise2: [noise_length]u8 = undefined; |
| 320 | 320 | crypto.random.bytes(&noise2); |
| 321 | h.update(&noise2); |
| 321 | 322 | if (noise) |*z| { |
| 322 | 323 | h.update(z); |
| 323 | 324 | } |
Frank Denis <124872+jedisct1@users.noreply.github.com> 2022-11-24 12:13:37+01:00