diff options
author | Justus Winter <justus@sequoia-pgp.org> | 2018-07-04 14:28:03 +0200 |
---|---|---|
committer | Justus Winter <justus@sequoia-pgp.org> | 2018-07-04 14:39:49 +0200 |
commit | 5110f999bdb76b93e8e2b10328f6c3e3c06e09ed (patch) | |
tree | fbdee2691d28846dfc2b4dfd9a340c32d215b4c3 /openpgp | |
parent | 984131932e76bf799feda676fc1899f6b78072f3 (diff) |
openpgp: Fix EdDSA corner case.
- MPI encoding can drop leading zero bytes, we need to add them back
prior to feeding the signature to nettle.
Diffstat (limited to 'openpgp')
-rw-r--r-- | openpgp/src/signature.rs | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/openpgp/src/signature.rs b/openpgp/src/signature.rs index 154c6c76..2c6ae6aa 100644 --- a/openpgp/src/signature.rs +++ b/openpgp/src/signature.rs @@ -308,11 +308,25 @@ impl Signature { // concatenated. let mut signature = Vec::with_capacity(ed25519::ED25519_SIGNATURE_SIZE); + + // We need to zero-pad them at the front, because + // the MPI encoding drops leading zero bytes. + let half = ed25519::ED25519_SIGNATURE_SIZE / 2; + for _ in 0..half - r.value.len() { + signature.push(0); + } signature.extend_from_slice(&r.value); + for _ in 0..half - s.value.len() { + signature.push(0); + } signature.extend_from_slice(&s.value); + + // Let's see if we got it right. if signature.len() != ed25519::ED25519_SIGNATURE_SIZE { return Err(Error::MalformedPacket( - "Invalid signature size".into()).into()); + format!( + "Invalid signature size: {}, r: {:?}, s: {:?}", + signature.len(), &r.value, &s.value)).into()); } ed25519::verify(&q.value[1..], hash, &signature) |