From 97fcd221f2208db00dc93237cbcf5503e0850b4b Mon Sep 17 00:00:00 2001 From: Felix Lange Date: Thu, 12 Jan 2017 15:37:48 +0100 Subject: [PATCH] crypto/secp256k1: add safety comments --- crypto/secp256k1/curve.go | 1 + crypto/secp256k1/secp256.go | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/crypto/secp256k1/curve.go b/crypto/secp256k1/curve.go index ccc5f5ce27..61cad54636 100644 --- a/crypto/secp256k1/curve.go +++ b/crypto/secp256k1/curve.go @@ -223,6 +223,7 @@ func (BitCurve *BitCurve) ScalarMult(Bx, By *big.Int, scalar []byte) (*big.Int, if len(scalar) > 32 { panic("can't handle scalars > 256 bits") } + // NOTE: potential timing issue padded := make([]byte, 32) copy(padded[32-len(scalar):], scalar) scalar = padded diff --git a/crypto/secp256k1/secp256.go b/crypto/secp256k1/secp256.go index ffa186108d..070e0d902f 100644 --- a/crypto/secp256k1/secp256.go +++ b/crypto/secp256k1/secp256.go @@ -72,6 +72,10 @@ var ( // Sign creates a recoverable ECDSA signature. // The produced signature is in the 65-byte [R || S || V] format where V is 0 or 1. +// +// The caller is responsible for ensuring that msg cannot be chosen +// directly by an attacker. It is usually preferable to use a cryptographic +// hash function on any input before handing it to this function. func Sign(msg []byte, seckey []byte) ([]byte, error) { if len(msg) != 32 { return nil, ErrInvalidMsgLen