X-Git-Url: https://asedeno.scripts.mit.edu/gitweb/?a=blobdiff_plain;f=sshecc.c;h=541dd63cdb885b9b645be8aa41c9d4ac6dcfbcc8;hb=af1460d6e5044a3344aaacd15c91cfdcb58578e7;hp=13b3cdd38d5caae16313e2304a7730ba4dce4a42;hpb=a209b9044e6536243b4c1b662300b2055776bab2;p=PuTTY.git

diff --git a/sshecc.c b/sshecc.c
index 13b3cdd3..541dd63c 100644
--- a/sshecc.c
+++ b/sshecc.c
@@ -24,6 +24,10 @@
  * Handbook of elliptic and hyperelliptic curve cryptography, Chapter 13
  *   http://cs.ucsb.edu/~koc/ccs130h/2013/EllipticHyperelliptic-CohenFrey.pdf
  *
+ * Curve25519 spec from libssh (with reference to other things in the
+ * libssh code):
+ *   https://git.libssh.org/users/aris/libssh.git/tree/doc/curve25519-sha256@libssh.org.txt
+ *
  * Edwards DSA:
  *   http://ed25519.cr.yp.to/ed25519-20110926.pdf
  */
@@ -1644,6 +1648,7 @@ static int decodepoint_ed(const char *p, int length, struct ec_point *point)
     /* Read x bit and then reset it */
     negative = bignum_bit(point->y, point->curve->fieldBits - 1);
     bignum_set_bit(point->y, point->curve->fieldBits - 1, 0);
+    bn_restore_invariant(point->y);
 
     /* Get the x from the y */
     point->x = ecp_edx(point->curve, point->y);
@@ -1766,6 +1771,7 @@ static void *ecdsa_newkey(const struct ssh_signkey *self,
     /* Curve name is duplicated for Weierstrass form */
     if (curve->type == EC_WEIERSTRASS) {
         getstring(&data, &len, &p, &slen);
+	if (!p) return NULL;
         if (!match_ssh_id(slen, p, curve->name)) return NULL;
     }
 
@@ -1777,11 +1783,11 @@ static void *ecdsa_newkey(const struct ssh_signkey *self,
     ec->publicKey.x = NULL;
     ec->publicKey.y = NULL;
     ec->publicKey.z = NULL;
+    ec->privateKey = NULL;
     if (!getmppoint(&data, &len, &ec->publicKey)) {
         ecdsa_freekey(ec);
         return NULL;
     }
-    ec->privateKey = NULL;
 
     if (!ec->publicKey.x || !ec->publicKey.y ||
         bignum_cmp(ec->publicKey.x, curve->p) >= 0 ||
@@ -2690,15 +2696,30 @@ static Bignum ecdh_calculate(const Bignum private,
     p->x = NULL;
 
     if (p->curve->type == EC_MONTGOMERY) {
-        /* Do conversion in network byte order */
+        /*
+         * Endianness-swap. The Curve25519 algorithm definition
+         * assumes you were doing your computation in arrays of 32
+         * little-endian bytes, and now specifies that you take your
+         * final one of those and convert it into a bignum in
+         * _network_ byte order, i.e. big-endian.
+         *
+         * In particular, the spec says, you convert the _whole_ 32
+         * bytes into a bignum. That is, on the rare occasions that
+         * p->x has come out with the most significant 8 bits zero, we
+         * have to imagine that being represented by a 32-byte string
+         * with the last byte being zero, so that has to be converted
+         * into an SSH-2 bignum with the _low_ byte zero, i.e. a
+         * multiple of 256.
+         */
         int i;
-        int bytes = (bignum_bitcount(ret)+7) / 8;
+        int bytes = (p->curve->fieldBits+7) / 8;
         unsigned char *byteorder = snewn(bytes, unsigned char);
         for (i = 0; i < bytes; ++i) {
             byteorder[i] = bignum_byte(ret, i);
         }
         freebn(ret);
         ret = bignum_from_bytes(byteorder, bytes);
+        smemclr(byteorder, bytes);
         sfree(byteorder);
     }