d0s3t3ch/wownero
1
0
Fork 0
mirror of https://git.wownero.com/wownero/wownero.git synced 2024-08-15 01:03:23 +00:00
Code Issues Projects Releases Wiki Activity

crypto: some paranoid checks in generate_signature/check_signature

Browse source 
Reported by QuarksLab.
This commit is contained in:
moneromooo-monero 2018-07-24 21:12:57 +01:00
parent 7434df1cc6
commit a4317e61b5
No known key found for this signature in database
GPG key ID: 686F07454D6CEFC3
1 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/crypto/crypto.cpp
View file

@ -274,11 +274,18 @@ namespace crypto {
#endif #endif
buf.h = prefix_hash; buf.h = prefix_hash;
buf.key = pub; buf.key = pub;
try_again:
random_scalar(k); random_scalar(k);
if (((const uint32_t*)(&k))[7] == 0) // we don't want tiny numbers here
goto try_again;
ge_scalarmult_base(&tmp3, &k); ge_scalarmult_base(&tmp3, &k);
ge_p3_tobytes(&buf.comm, &tmp3); ge_p3_tobytes(&buf.comm, &tmp3);
hash_to_scalar(&buf, sizeof(s_comm), sig.c); hash_to_scalar(&buf, sizeof(s_comm), sig.c);
if (!sc_isnonzero((const unsigned char*)sig.c.data))
goto try_again;
sc_mulsub(&sig.r, &sig.c, &unwrap(sec), &k); sc_mulsub(&sig.r, &sig.c, &unwrap(sec), &k);
if (!sc_isnonzero((const unsigned char*)sig.r.data))
goto try_again;
} }
bool crypto_ops::check_signature(const hash &prefix_hash, const public_key &pub, const signature &sig) { bool crypto_ops::check_signature(const hash &prefix_hash, const public_key &pub, const signature &sig) {
@ -292,11 +299,14 @@ namespace crypto {
if (ge_frombytes_vartime(&tmp3, &pub) != 0) { if (ge_frombytes_vartime(&tmp3, &pub) != 0) {
return false; return false;
} }
if (sc_check(&sig.c) != 0 || sc_check(&sig.r) != 0) { if (sc_check(&sig.c) != 0 || sc_check(&sig.r) != 0 || !sc_isnonzero(&sig.c)) {
return false; return false;
} }
ge_double_scalarmult_base_vartime(&tmp2, &sig.c, &tmp3, &sig.r); ge_double_scalarmult_base_vartime(&tmp2, &sig.c, &tmp3, &sig.r);
ge_tobytes(&buf.comm, &tmp2); ge_tobytes(&buf.comm, &tmp2);
static const ec_point infinity = {{ 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}};
if (memcmp(&buf.comm, &infinity, 32) == 0)
return false;
hash_to_scalar(&buf, sizeof(s_comm), c); hash_to_scalar(&buf, sizeof(s_comm), c);
sc_sub(&c, &c, &sig.c); sc_sub(&c, &c, &sig.c);
return sc_isnonzero(&c) == 0; return sc_isnonzero(&c) == 0;