test(ed25519-verify): add mixed-order strict-parity regression vectors - #9
Conversation
|
FYI: PR #11 refactors scalar.rs and verifier.rs, the same files this fix touches. Happy to rebase once it lands, or adapt the fix to the refactored code if that helps. Flagging it so the parity fix does not get lost in the refactor. |
Fold order-2 and order-4 torsion into prime-order public keys and assert the cofactorless strict preset agrees with ed25519-dalek's verify_strict on them. These vectors fail on the code before the runtime scalar negation was removed (PR #10) and pass on main. The maintainer fix replaces scalar::negate with a negated basepoint constant; these vectors lock in that parity behavior.
a09654c to
06928b6
Compare
latent-9
changed the title
|
@zz-sol can you take a look? |
Re-verifies the mixed-order vectors against the refactored verifier: cargo test workspace-wide green, including dalek_verify_strict_preset_matches_dalek.
|
Merged current main (including the #11 refactor) into this branch and re-ran the suite: cargo test is green workspace-wide, with dalek_verify_strict_preset_matches_dalek still passing on the new mixed-order vectors. No adaptation was needed since the added cases live in the parity test table and touch no error-enum assertions. Ready for review. |
|
@joncinque @zz-sol thank you for the quick review and for merging this. Being allowed to contribute even a small piece to this ecosystem is appreciated, and thanks to everyone maintaining these crates. |
3 participants
While fuzzing this crate against ed25519-dalek I found that the cofactorless strict preset disagreed with dalek's
verify_stricton signatures where a low-order torsion component is folded into a prime-order public key. The root cause was the runtime scalar negation (L - H): the group orderLis odd, so(L - H)*Adiffers from-(H*A)byL*A, which is only the identity whenAhas prime order. On a mixed-order key it leaves a non-identityL*Ttorsion component, so cofactorless verification returned the wrong verdict.That fix has since landed in main as part of #10, which removes the runtime scalar negation. This PR adds the regression vectors that prove that fix:
verify_strictaccepts.dalek_verify_strict_preset_matches_dalek, which asserts the preset returns the same verdict as dalek.On the code before #10 the preset rejects these signatures (the bug), and on main it accepts them (fixed). No production code changes.