فهرست منبع

LibCrypto: Fix SECP384r1 verification when hash is SHA256

Some websites actually provide a SECP384 certificate which is signed
using a SHA256 hash. We assumed that SECP384 always used a SHA384 hash,
but this is not the case.
Michiel Visser 1 سال پیش
والد
کامیت
000f0274e2
1فایلهای تغییر یافته به همراه5 افزوده شده و 2 حذف شده
  1. 5 2
      Userland/Libraries/LibCrypto/Curves/SECPxxxr1.h

+ 5 - 2
Userland/Libraries/LibCrypto/Curves/SECPxxxr1.h

@@ -196,8 +196,11 @@ public:
         }
 
         // z is the hash
-        AK::FixedMemoryStream hash_stream { hash };
-        StorageType z = TRY(hash_stream.read_value<BigEndian<StorageType>>());
+        StorageType z = 0u;
+        for (uint8_t byte : hash) {
+            z <<= 8;
+            z |= byte;
+        }
 
         AK::FixedMemoryStream pubkey_stream { pubkey };
         JacobianPoint pubkey_point = TRY(read_uncompressed_point(pubkey_stream));