Critical security fix in verifyWithMessage

TogaTech · Jun 15, 2021 · a121b34 · a121b34
1 parent 4e7169c
commit a121b34
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/node/tenvoy.js b/node/tenvoy.js
@@ -2166,7 +2166,7 @@ function tEnvoyNaClSigningKey(key, type = "secret", password = null, passwordPro
 			throw "tEnvoyNaClSigningKey Fatal Error: Invalid signature.";
 		}
 		let hash = _tEnvoy.util.hexToBytes(signed.split("::")[0]);
-		return this.verify(signed, password) && _tEnvoy.util.bytesToHex(_nacl.hash(_tEnvoy.util.pack(message))) == _tEnvoy.util.bytesToHex(hash);
+		return this.verify(signed, password).verified && _tEnvoy.util.bytesToHex(_nacl.hash(_tEnvoy.util.pack(message))) == _tEnvoy.util.bytesToHex(hash);
 	}
 
 	this.toPublic = (password = null) => {

diff --git a/tenvoy.js b/tenvoy.js
@@ -48183,7 +48183,7 @@ function tEnvoyNaClSigningKey(key, type = "secret", password = null, passwordPro
 			throw "tEnvoyNaClSigningKey Fatal Error: Invalid signature.";
 		}
 		let hash = _tEnvoy.util.hexToBytes(signed.split("::")[0]);
-		return this.verify(signed, password) && _tEnvoy.util.bytesToHex(_nacl.hash(_tEnvoy.util.pack(message))) == _tEnvoy.util.bytesToHex(hash);
+		return this.verify(signed, password).verified && _tEnvoy.util.bytesToHex(_nacl.hash(_tEnvoy.util.pack(message))) == _tEnvoy.util.bytesToHex(hash);
 	}
 
 	this.toPublic = (password = null) => {