search

keybase / go-crypto

[mirror] Go supplementary cryptography libraries
https://godoc.org/golang.org/x/crypto
BSD 3-Clause "New" or "Revised" License
50 stars 20 forks source link

change E to int64 to fit bigger exponents we see in the wild #8

Closed maxtaco closed 8 years ago

maxtaco commented 8 years ago
maxtaco commented 8 years ago

r? @oconnor663

maxtaco commented 8 years ago

Confirmed this fixes the problem with keybase id cr0bar

oconnor663 commented 8 years ago

Oh dear. Is there a way to see a diff of what we changed, apart from the copies?

cr0bar commented 8 years ago

@oconnor663 I can see the changes here:

https://github.com/keybase/go-crypto/pull/8/files

Change to import, 1 if statement and the type change to int64

Both public key and public key v3 files changed.

cr0bar commented 8 years ago

Ignore my comment, realise what you mean now.

maxtaco commented 8 years ago

Our options are limited since the library we need to fix is in go core

On Saturday, February 6, 2016, oconnor663 notifications@github.com wrote:

Oh dear. Is there a way to see a diff of what we changed, apart from the copies?

— Reply to this email directly or view it on GitHub https://github.com/keybase/go-crypto/pull/8#issuecomment-180707720.

maxtaco commented 8 years ago

the only change in the RSA library is from int to int64 and a few fixed

-of bits computations

On Sat, Feb 6, 2016 at 7:09 AM, Maxwell Krohn themax@gmail.com wrote:

Our options are limited since the library we need to fix is in go core

On Saturday, February 6, 2016, oconnor663 notifications@github.com wrote:

Oh dear. Is there a way to see a diff of what we changed, apart from the copies?

— Reply to this email directly or view it on GitHub https://github.com/keybase/go-crypto/pull/8#issuecomment-180707720.

maxtaco commented 8 years ago

My general strategy was just to change the type of E to int64 and then fix the compile errors as they came up. The actually use of the int is fine, since it's thrown up into a big.Int

oconnor663 commented 8 years ago

No other comments, other than my general worry about changing crypto code. What's the class of keys that require this big E?

maxtaco commented 8 years ago

I've seen 3 offenders to far. It's not changing the code that has me worried, as much as having to fork and missing security updates in the future.