Closed WildCryptoFox closed 5 years ago
I doubt this matters so much for schnorrkel, but we've just pushed a breaking change, so addressing any worries here makes sense. Thanks!
I added labels for the challenges and witnesses too. I'll go ahead and publish 0.3 but let me know if you notice anything else worth fixing around the hashing or whatever. :)
@burdges Looks good, but you forgot the null terminators on the new witness and challenge labels. I doubt as well, but better safe than sorry!
Meh, that really does not impact anything, but for consistency.
I've also yanked all versions prior to 0.4 except those being used by parity in their test net.. and those will be yanked once parity updates.
In
vrf.rs
the transcript labelh
is a prefix ofh^r
andh^sk
. The lengths of labels are not included in the hash, allowing for distinct transcripts to converge with malicious inputs. However, this particular use is fine as (a) the protocol is linear without branches and (b) the inputs are constant size - with their length included in the input; I have not done a pass over the remaining transcripts to verify they are immune to this subtle detail.Simple fix: reserve a character for termination.
\x00
or.
perhaps. IMO this is a bug in merlin, but when I brought up the issue in #merlin on dalek-cryptography on slack they updated their documentation, defining a transcript protocol; emphasis mine.