mirror of
https://github.com/hanzoai/elliptic.git
synced 2026-09-23 23:51:03 +00:00
Kyle Den HartogandFedor Indutny
af0dd72eb9
This update checks to make sure that the public key passed in to ECDH is a point that actually exists on the curve. This is important to prevent a twist attack that can be used to reveal the private key of a party in an ECDH operation over a number of occurances. For more details on the attack see this blog post: https://github.com/christianlundkvist/blog/blob/master/2020_05_26_secp256k1_twist_attacks/secp256k1_twist_attacks.md CVE: CVE-2020-28498
44 lines
1.3 KiB
JavaScript
44 lines
1.3 KiB
JavaScript
/* eslint-env node, mocha */
|
|
'use strict';
|
|
|
|
var assert = require('assert');
|
|
var elliptic = require('../');
|
|
|
|
describe('ECDH', function() {
|
|
function test(name) {
|
|
it('should work with ' + name + ' curve', function() {
|
|
var ecdh = new elliptic.ec(name);
|
|
var s1 = ecdh.genKeyPair();
|
|
var s2 = ecdh.genKeyPair();
|
|
var sh1 = s1.derive(s2.getPublic());
|
|
var sh2 = s2.derive(s1.getPublic());
|
|
|
|
assert.equal(sh1.toString(16), sh2.toString(16));
|
|
|
|
sh1 = s1.derive(ecdh.keyFromPublic(s2.getPublic('hex'), 'hex')
|
|
.getPublic());
|
|
sh2 = s2.derive(ecdh.keyFromPublic(s1.getPublic('hex'), 'hex')
|
|
.getPublic());
|
|
assert.equal(sh1.toString(16), sh2.toString(16));
|
|
});
|
|
}
|
|
|
|
test('curve25519');
|
|
test('ed25519');
|
|
test('secp256k1');
|
|
});
|
|
|
|
describe('ECDH twist attack', () => {
|
|
it('should be able to prevent a twist attack for secp256k1', () => {
|
|
var bobEcdh = new elliptic.ec('secp256k1');
|
|
var malloryEcdh = new elliptic.ec('secp256k1');
|
|
var bob = bobEcdh.genKeyPair();
|
|
// This is a bad point that shouldn't be able to be passed to derive.
|
|
// If a bad point can be passed it's possible to perform a twist attack.
|
|
var mallory = malloryEcdh.keyFromPublic({ x: 14, y: 16 });
|
|
assert.throws(function () {
|
|
bob.derive(mallory.getPublic());
|
|
});
|
|
});
|
|
});
|