View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0009953 | Taler | qtart | public | 2025-05-13 12:12 | 2025-08-31 17:40 |
| Reporter | fefe | Assigned To | Resolution deadline | ||
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | normal | Severity | minor | Reproducibility | have not tried |
| Status | implementing | Resolution | open | ||
| Product Version | 1.0 | ||||
| Target Version | post-1.0 | ||||
| Summary | 0009953: unexplained numeric constants in js_talercrypto_eddsa_sign | ||||
| Description | In tart_module.c: 595 unsigned char sk[crypto_sign_SECRETKEYBYTES]; 596 unsigned char pk[crypto_sign_PUBLICKEYBYTES]; 597 unsigned char sig[64]; Why 64? 605 seed = JS_GetArrayBuffer(ctx, &seed_size, argv[1]); 606 if (!seed) { 607 return JS_EXCEPTION; 608 } 609 if (seed_size != 32) { 610 return JS_ThrowTypeError(ctx, "invalid private key size"); 611 } Why 32? Also the error string is probably wrong because crypto_sign_SECRETKEYBYTES is 64 not 32. 617 res = crypto_sign_detached((uint8_t *)sig, 618 NULL, 619 (uint8_t *)data, 620 data_size, 621 sk); The second argument (NULL here) is supposed to return the size of the signature (always 64). 625 return make_js_ta_copy(ctx, sig, 64); This looks like it is meant to be algorithm agnostic (calls crypto_sign_detached instead of crypto_sign_ed25519_detached), but what if a future version of libsodium changes the algorithm and thus the sizes change too? Maybe better call the ed25519 function directly? | ||||
| Tags | security | ||||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2025-05-13 12:12 | fefe | New Issue | |
| 2025-05-13 12:39 | Christian Grothoff | Assigned To | => Florian Dold |
| 2025-05-13 12:39 | Christian Grothoff | Status | new => assigned |
| 2025-06-04 22:06 | Florian Dold | Target Version | => 1.1 |
| 2025-06-04 22:22 | Christian Grothoff | Tag Attached: security | |
| 2025-06-04 23:55 | Florian Dold | Target Version | 1.1 => 1.6 |
| 2025-08-31 17:25 | Christian Grothoff | Product Version | => 1.0 |
| 2025-08-31 17:25 | Christian Grothoff | Target Version | 1.6 => post-1.0 |
| 2025-08-31 17:40 | Christian Grothoff | Assigned To | Florian Dold => |
| 2025-08-31 17:40 | Christian Grothoff | Status | assigned => implementing |