Make IsValidHostname More Robust #24

sarah · 2021-09-28T20:50:51Z

sarah commented

2021-09-28 20:50:51 +00:00

IsValidHostname now rejects public keys that are invalid ed25519
curve points in addition to ed25519 points that contain torsion
components (which are defined to be invalid Tor Hostnames).

Note: The lack of these checks previously would have been unlikely to manifest as an issue further up the
stack because Tor would have prevented Cwtch from connecting to bad curve
points, the Tapir authentication protocol would have failed with invalid curve points,
and the experimental group chats only rely on signatures for voluntary authorship attribution,
rather than e.g. consensus or security.

IsValidHostname now rejects public keys that are invalid ed25519 curve points in addition to ed25519 points that contain torsion components (which are defined to be invalid Tor Hostnames). Note: The lack of these checks previously would have been unlikely to manifest as an issue further up the stack because Tor would have prevented Cwtch from connecting to bad curve points, the Tapir authentication protocol would have failed with invalid curve points, and the experimental group chats only rely on signatures for voluntary authorship attribution, rather than e.g. consensus or security.

erinn was assigned by sarah

2021-09-28 20:50:51 +00:00

sarah force-pushed validation from 49c4b0ce76 to babb3ad1bf

2021-09-28 20:58:32 +00:00

Compare

buildbot commented

2021-09-28 21:00:58 +00:00

First-time contributor

Drone Build Status: failure

https://build.openprivacy.ca/openprivacy/connectivity/57

Drone Build Status: failure https://build.openprivacy.ca/openprivacy/connectivity/57

sarah force-pushed validation from 87dc3a5315 to 8fe2974aaa