Join GitHub today
crypto/ed25519: add edge case tests #40478
https://github.com/hdevalence/ed25519consensus is a fork of crypto/ed25519 with a
Relevant to this issue, the
The difference between (my interpretation of) RFC 8032 and the current Go behaviour can be visualized as follows:
On the left, the dark shade indicates MUST-reject (according to RFC 8032, which was written after this implementation and is incompatible with it), medium indicates MAY-accept, light indicates MUST-accept. (RFC 8032 does not require implementations to agree on whether signatures are valid). On the right, dark and light indicate rejected and accepted, respectively.
Note that all of these test cases require carefully crafted public keys. Therefore, there's no security issue with the signatures themselves, because an attacker who can control the public key can sign any message whatsoever. The problem is just the inconsistency, which could allow, e.g., a malicious party to inject faults into a consensus algorithm and cause consensus divergence.