keygen: fix over-stripping of ED25519 public key bytes - #1515
Open
Soulstears2539 wants to merge 1 commit into
Open
keygen: fix over-stripping of ED25519 public key bytes#1515Soulstears2539 wants to merge 1 commit into
Soulstears2539 wants to merge 1 commit into
Conversation
parseDERs() removed *all* leading 0x00 bytes from the ED25519 SubjectPublicKeyInfo BIT STRING content instead of exactly the one mandatory 'unused bits' marker byte. Whenever the raw 32-byte public key itself happened to start with 0x00 (~1/256 keys), the loop over-stripped real key material, producing a truncated key that parseKey() then correctly rejected as 'Malformed OpenSSH public key'. Fixes mscdex#1514.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1514.
Summary
parseDERs()inlib/keygen.jsremoved all leading0x00bytes fromthe ED25519
SubjectPublicKeyInfoBIT STRING content instead of exactlythe one mandatory "unused bits" marker byte. Whenever the raw 32-byte
public key itself happened to start with
0x00(~1/256 keys), the loopover-stripped real key material, producing a truncated key that
parseKey()then correctly rejected asMalformed OpenSSH public key.Fix
Strip exactly one byte when it is
0x00, not a variable-length run.Note: the analogous
ec(ECDSA) case uses the same style of loop but isnot affected, since the byte immediately following the leading
0x00isalways the fixed
0x04uncompressed-point marker (never zero), so thatloop always stops after exactly one byte regardless of the X/Y coordinate
values. Left unchanged.
Testing
generateKeyPairSync('ed25519')+parseKey()) over20000 iterations: 85 failures before the fix, 0 failures after.
test/test-keygen.js(existing suite) passes unchanged.