crypto: reject small-order EdDSA points during verify · nodejs/node@0908d76 · GitHub
Skip to content

Commit 0908d76

Browse files
panvarichardlau
panva
authored and
richardlau
committed
crypto: reject small-order EdDSA points during verify
Return false for Ed25519 and Ed448 one-shot verification when the public key or signature R component is a known low-order point. This keeps key import behavior unchanged while making WebCrypto verification match WPT expectations across OpenSSL variants. Remove the stale WPT expected-failure entry and add focused regression coverage for both curves. Closes: #54572 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #64026 Fixes: #54572 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
1 parent 1f72393 commit 0908d76

3 files changed

Lines changed: 184 additions & 20 deletions

File tree

‎src/crypto/crypto_sig.cc‎

Lines changed: 143 additions & 1 deletion

‎test/parallel/test-webcrypto-sign-verify-eddsa.js‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,44 @@ const vectors = require('../fixtures/crypto/eddsa')();
1515

1616
const supportsContext = hasOpenSSL(3, 2);
1717

18+
const smallOrderVerifyVectors = [
19+
{
20+
name: 'Ed25519',
21+
publicKey: Buffer.from(
22+
'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
23+
'hex'),
24+
signature: Buffer.from(
25+
'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a' +
26+
'0000000000000000000000000000000000000000000000000000000000000000',
27+
'hex'),
28+
data: Buffer.from(
29+
'8c93255d71dcab10e8f379c26200f3c7bd5f09d9bc3068d3ef4edeb4853022b6',
30+
'hex'),
31+
},
32+
];
33+
34+
if (!process.features.openssl_is_boringssl) {
35+
smallOrderVerifyVectors.push({
36+
name: 'Ed448',
37+
publicKey: Buffer.concat([Buffer.from([1]), Buffer.alloc(56)]),
38+
signature: Buffer.concat([Buffer.from([1]), Buffer.alloc(113)]),
39+
data: Buffer.from([1, 2, 3]),
40+
});
41+
}
42+
43+
async function testSmallOrderVerify({ name, publicKey, signature, data }) {
44+
const key = await subtle.importKey(
45+
'raw',
46+
publicKey,
47+
{ name },
48+
false,
49+
['verify']);
50+
51+
assert.strictEqual(
52+
await subtle.verify({ name }, key, signature, data),
53+
false);
54+
}
55+
1856
async function testVerify({ name,
1957
context,
2058
publicKeyBuffer,
@@ -260,6 +298,9 @@ async function testSign({ name,
260298
variations.push(testVerify(vector));
261299
variations.push(testSign(vector));
262300
});
301+
smallOrderVerifyVectors.forEach((vector) => {
302+
variations.push(testSmallOrderVerify(vector));
303+
});
263304

264305
await Promise.all(variations);
265306
})().then(common.mustCall());

‎test/wpt/status/WebCryptoAPI.cjs‎

Lines changed: 0 additions & 19 deletions

0 commit comments

Comments
 (0)