authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2022-11-24 12:13:37+01:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2022-11-24 12:13:37+01:00
logfeb806a212355956a33cc843a6d593741b93c5ec
tree55577e257e02bbf07a4afa251110d61cd09b347f
parent02e1facc72fa9cb8e4793ecf114fdd61ea8df6bd
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

std.crypto.ed25519 incremental signatures: hash the fallback noise (#13643)

If the noise parameter was null, we didn't use any noise at all. We unconditionally generated random noise (`noise2`) but didn't use it. Spotted by @cryptocode, thanks!

1 files changed, 1 insertions(+), 0 deletions(-)

lib/std/crypto/25519/ed25519.zig+1
......@@ -318,6 +318,7 @@ pub const Ed25519 = struct {
318318 h.update(&scalar_and_prefix.prefix);
319319 var noise2: [noise_length]u8 = undefined;
320320 crypto.random.bytes(&noise2);
321 h.update(&noise2);
321322 if (noise) |*z| {
322323 h.update(z);
323324 }