From: James Prestwood <prestwoj@gmail.com>
To: ell@lists.linux.dev
Cc: James Prestwood <prestwoj@gmail.com>
Subject: [PATCH v2 1/2] ecc: fix incorrect derivation of compressed points
Date: Tue, 10 Oct 2023 07:25:05 -0700 [thread overview]
Message-ID: <20231010142506.261152-1-prestwoj@gmail.com> (raw)
The logic was inversed here and was performing a subtraction if:
- Y was even and type == BIT0
- Y was odd and type == BIT1
This is not correct according to the ANSI spec. IWD relied on this
API but had matching incorrect logic so things "worked" up until
a compressed point needed to be parsed from an source that
explicitly specified the type (e.g. an ASN1 DER in DPP). All other
uses (PWD/SAE) the point type was only used to force a subtraction
so since both locations used the incorrect logic the points would
compute correctly.
---
ell/ecc.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/ell/ecc.c b/ell/ecc.c
index 98ef812..73ddb96 100644
--- a/ell/ecc.c
+++ b/ell/ecc.c
@@ -562,8 +562,24 @@ LIB_EXPORT struct l_ecc_point *l_ecc_point_from_data(
if (!_ecc_compute_y(curve, p->y, p->x))
goto failed;
+ /*
+ * This is determining whether or not to subtract the Y
+ * coordinate from P. According to ANSI X9.62 an even Y should
+ * be prefixed with 02 (BIT0) and an odd Y should be prefixed
+ * with 03 (BIT1). If this is not the case, subtract Y from P.
+ *
+ * ANSI X9.62
+ * 4.3.6 Point-to-Octet-String Conversion
+ *
+ * 2. If the compressed form is used, then do the following:
+ * 2.1. Compute the bit ~Yp . (See Section 4.2.)
+ * 2.2. Assign the value 02 to the single octet PC if ~Yp
+ * is 0, or the value 03 if ~Yp is 1.
+ * 2.3. The result is the octet string PO = PC || X
+ */
+
sub = secure_select(type == L_ECC_POINT_TYPE_COMPRESSED_BIT0,
- !(p->y[0] & 1), p->y[0] & 1);
+ p->y[0] & 1, !(p->y[0] & 1));
_vli_mod_sub(tmp, curve->p, p->y, curve->p, curve->ndigits);
--
2.25.1
next reply other threads:[~2023-10-10 14:25 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-10 14:25 James Prestwood [this message]
2023-10-10 14:25 ` [PATCH v2 2/2] unit: update test-ecc with compressed point bug fix James Prestwood
2023-10-11 15:26 ` Denis Kenzior
2023-10-11 14:55 ` [PATCH v2 1/2] ecc: fix incorrect derivation of compressed points Denis Kenzior
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231010142506.261152-1-prestwoj@gmail.com \
--to=prestwoj@gmail.com \
--cc=ell@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).