mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-09 01:32:06 +02:00
Tobias Frauenschläger
d7a5e85716
Ed448 verification rejects a non-canonical signature scalar S (S >= L) per RFC 8032, and that range check is the only guard against a malleated signature: because L times the base point is the identity, (R, S + L) recomputes the same R and would otherwise verify. The check had no negative coverage, so a deletion or boundary mutation passed the suite while all canonical KAT signatures kept working. Add a test that signs a message, then verifies crafted signatures whose S half equals the order, exceeds it in a high or low byte, and equals S + L, asserting BAD_FUNC_ARG, plus an in-range wrong S asserting SIG_VERIFY_E. Fixes F-6777.
Before creating any new configure files (.conf) read the CONF_FILES_README.md