Skip to content

Conversation

@ColtonWilley
Copy link
Contributor

Libssh2 generates and then exports a curve25519 private key. If we generated the key, we are incorrectly clamping the private key with zero values on export. Fix to only clamp if key was imported.

@ColtonWilley ColtonWilley requested a review from SparkiDev May 1, 2025 20:28
@padelsbach
Copy link
Contributor

padelsbach commented May 1, 2025

ecx->hasPriv is checked for private keys around like 793. Should ecx->clamped be checked there as well?

Edit: I believe not since this key may have been generated, and thus not clamped.

@ColtonWilley
Copy link
Contributor Author

ecx->hasPriv is checked for private keys around like 793. Should ecx->clamped be checked there as well?

I dont think so. Whether it has an underlying private key is independent of clamping.

@padelsbach
Copy link
Contributor

padelsbach commented May 1, 2025

ecx->hasPriv is checked for private keys around like 793. Should ecx->clamped be checked there as well?

Edit: I believe not since this key may have been generated, and thus not clamped.

In any case, it might be good to add a comment that the clamped flag is specifically for imported and not generated keys

@SparkiDev SparkiDev self-assigned this May 1, 2025
@SparkiDev SparkiDev merged commit 05cbdf5 into wolfSSL:master May 1, 2025
49 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants