chore(crypto): add publickey verification #3974
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## Summary Current master/develop only checks for valid hex during PublicKey validation, but does not verify the correctness of a publicKey. This can lead to the unexpected creation of an unaccessable but technically-"valid" Address. This PR recommends the following: - add a 'verify' method to 'class PublicKey' using the already-present 'secp256k1' module - modify 'Address.fromPublicKey' to drop hex-validation in favor of 'PublicKey.verify' - add relevant unit-tests ## Additional Comments - No change of import modules needed - maintains resolution of circular-dep fixes in c84b976 There are other areas thay would benefit from the 'PublicKey.verify' method; however, no additional checks are being added at this time. It should also be stated that a developer should use this new method whenever: - the correctness of a publicKey cannot be guaranteed - the publicKey is NOT already being checked (`.verify(sig, pubKey, msg)`)
sleepdefic1t
requested review from
air1one,
faustbrian and
kristjank
as code owners
Codecov Report
@@ Coverage Diff @@
## develop #3974 +/- ##
===========================================
- Coverage 97.44% 95.69% -1.76%
===========================================
Files 631 631
Lines 14582 14582
Branches 1734 1734
===========================================
- Hits 14210 13954 -256
- Misses 181 437 +256
Partials 191 191
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
ghost
mentioned this pull request
Use valid publicKeys to resolve failing tests after adding PKV.
|
No idea what's up with functional/htlc-lock tests step:10:208, doesn't appear to be anything I touched. |
air1one
approved these changes
Aug 25, 2020
ghost
deleted the
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Current master/develop only checks for valid hex during PublicKey validation, but does not verify the correctness of a publicKey.
This can lead to the unexpected creation of an unaccessible but technically-"valid" Address.
This PR recommends the following:
verifymethod toclass PublicKeyusing the already-presentsecp256k1moduleAddress.fromPublicKeyto drop hex-validation in favor ofPublicKey.verifyPublicKey.fromMultiSignatureAssetto drop hex-validation in favor ofPublicKey.verifyChecklist
Additional Comments
There are other areas that would benefit from the
PublicKey.verifymethod; however, no additional checks are being added at this time.It should also be stated that a developer should use this new method whenever:
.verify(sig, pubKey, msg))