We'll want to add tests for the edge cases that led to #40475.
Ideally, they would go into Wycheproof and run from there, making sure they run against all architectures.
/cc @hdevalence @katiehockman
FiloSottile
All 2 comments
https://github.com/hdevalence/ed25519consensus is a fork of crypto/ed25519 with a VerifyConsensus method implementing the ZIP215 validation rules described in that repo. (Please forgive my Go, I don't write it regularly).
Relevant to this issue, the zip215_test.go file in that repo has a list of 196 = 14^2 test vectors consisting of purported (public key, signature) pairs on the message b"Zcash". These are constructed by taking pairs from a list of 14 encodings of low-order points, 8 of which are canonically encoded and 6 of which are non-canonically encoded.
The difference between (my interpretation of) RFC 8032 and the current Go behaviour can be visualized as follows:
RFC 8032 (as interpreted) | Go crypto/ed25519 |
--------------------------|-------------------
| 
On the left, the dark shade indicates MUST-reject (according to RFC 8032, which was written after this implementation and is incompatible with it), medium indicates MAY-accept, light indicates MUST-accept. (RFC 8032 does not require implementations to agree on whether signatures are valid). On the right, dark and light indicate rejected and accepted, respectively.
Note that all of these test cases require carefully crafted public keys. Therefore, there's no security issue with the signatures themselves, because an attacker who can control the public key can sign any message whatsoever. The problem is just the inconsistency, which could allow, e.g., a malicious party to inject faults into a consensus algorithm and cause consensus divergence.
hdevalence
on 30 Jul 2020
There's more context in @hdevalence's article here: https://hdevalence.ca/blog/2020-10-04-its-25519am
Indeed, since there is no security risk we probably should not change the behavior now and risk forking some blockchains. We'll add test cases and a paragraph to the docs.
FiloSottile
on 5 Oct 2020
Related issues
stub42
·
3Comments
ajstarks
·
3Comments
rsc
·
3Comments
lkarlslund
·
3Comments
myitcv
·
3Comments
Most helpful comment
https://github.com/hdevalence/ed25519consensus is a fork of crypto/ed25519 with a
VerifyConsensusmethod implementing the ZIP215 validation rules described in that repo. (Please forgive my Go, I don't write it regularly).Relevant to this issue, the
zip215_test.gofile in that repo has a list of 196 = 14^2 test vectors consisting of purported (public key, signature) pairs on the messageb"Zcash". These are constructed by taking pairs from a list of 14 encodings of low-order points, 8 of which are canonically encoded and 6 of which are non-canonically encoded.The difference between (my interpretation of) RFC 8032 and the current Go behaviour can be visualized as follows:
RFC 8032 (as interpreted) | Go crypto/ed25519 |
| 
--------------------------|-------------------
On the left, the dark shade indicates MUST-reject (according to RFC 8032, which was written after this implementation and is incompatible with it), medium indicates MAY-accept, light indicates MUST-accept. (RFC 8032 does not require implementations to agree on whether signatures are valid). On the right, dark and light indicate rejected and accepted, respectively.
Note that all of these test cases require carefully crafted public keys. Therefore, there's no security issue with the signatures themselves, because an attacker who can control the public key can sign any message whatsoever. The problem is just the inconsistency, which could allow, e.g., a malicious party to inject faults into a consensus algorithm and cause consensus divergence.