From 600880a0a4930f71884a3207ba39dcaf68c3e698 Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Fri, 10 Jul 2026 07:20:10 +0200 Subject: [PATCH] curve25519: fix big-endian public-key order check operand wc_curve25519_check_public's BIG_ENDIAN branch checked pub[i] != 0 in its top-order boundary loop where the mirrored LITTLE_ENDIAN branch checks pub[i] != 0xff. The field prime p = 2^255 - 19 has 0xff middle bytes, so the != 0 test broke out on the first non-0xff byte and the near-prime rejection was effectively non-functional for big-endian inputs. Match the little-endian branch so out-of-range big-endian public keys are rejected. --- wolfcrypt/src/curve25519.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wolfcrypt/src/curve25519.c b/wolfcrypt/src/curve25519.c index 12efe361f9..8e7afec540 100644 --- a/wolfcrypt/src/curve25519.c +++ b/wolfcrypt/src/curve25519.c @@ -977,7 +977,7 @@ int wc_curve25519_check_public(const byte* pub, word32 pubSz, int endian) /* Check for order-1 or higher. */ if (pub[0] == 0x7f) { for (i = 1; i < CURVE25519_KEYSIZE - 1; i++) { - if (pub[i] != 0) + if (pub[i] != 0xff) break; } if (i == CURVE25519_KEYSIZE - 1 && (pub[i] >= 0xec))