authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2022-11-24 12:13:37+01:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2022-12-22 23:06:28+01:00
logee8af8cffb42603ead90db6a3d7b7df9f2b2a683
treec5bfd7c92ff25cb494b3cf56d8e2d9e3902937ad
parent3ee5cf627fbf2e5e006535b25d48e070b4442ce8

std.crypto.ed25519 incremental signatures: hash the fallback noise (#13643)

If the noise parameter was null, we didn't use any noise at all. We unconditionally generated random noise (`noise2`) but didn't use it. Spotted by @cryptocode, thanks!

1 files changed, 1 insertions(+), 0 deletions(-)

lib/std/crypto/25519/ed25519.zig+1
...@@ -318,6 +318,7 @@ pub const Ed25519 = struct {...@@ -318,6 +318,7 @@ pub const Ed25519 = struct {
318 h.update(&scalar_and_prefix.prefix);318 h.update(&scalar_and_prefix.prefix);
319 var noise2: [noise_length]u8 = undefined;319 var noise2: [noise_length]u8 = undefined;
320 crypto.random.bytes(&noise2);320 crypto.random.bytes(&noise2);
321 h.update(&noise2);
321 if (noise) |*z| {322 if (noise) |*z| {
322 h.update(z);323 h.update(z);
323 }324 }