Merge pull request #2693 from canokeys/fix_invalid_kek
fix the compatibility of compressed and uncompressed format in ECDH
This commit is contained in:
commit
483e771ed7
|
@ -161,14 +161,26 @@ public class PsoDecryptTokenOp {
|
||||||
*/
|
*/
|
||||||
byte[] keyEncryptionKey = response.getData();
|
byte[] keyEncryptionKey = response.getData();
|
||||||
|
|
||||||
int xLen;
|
/* From rfc6637#section-7 :
|
||||||
if (eckf.isX25519()) {
|
The input of KDF should be the x portion of the point.
|
||||||
xLen = keyEncryptionKey.length;
|
As the result of ECDH can be expressed in two formats: compressed and uncompressed,
|
||||||
} else {
|
we have to deal with each case:
|
||||||
|
An uncompressed point is encoded as 04 || x || y, with x and y are of the same size.
|
||||||
|
However, a valid x may be led with 04, so we have to also check the length of the result.
|
||||||
|
A compressed point, on the other hand, is encoded as x only. Therefore, we use the value directly.
|
||||||
|
*/
|
||||||
|
int xLen, startPos;
|
||||||
|
if (keyEncryptionKey[0] == 0x04 && keyEncryptionKey.length % 2 == 1) {
|
||||||
|
// uncompressed format
|
||||||
xLen = (keyEncryptionKey.length - 1) / 2;
|
xLen = (keyEncryptionKey.length - 1) / 2;
|
||||||
|
startPos = 1;
|
||||||
|
} else {
|
||||||
|
// compressed format
|
||||||
|
xLen = keyEncryptionKey.length;
|
||||||
|
startPos = 0;
|
||||||
}
|
}
|
||||||
final byte[] kekX = new byte[xLen];
|
final byte[] kekX = new byte[xLen];
|
||||||
System.arraycopy(keyEncryptionKey, eckf.isX25519() ? 0 : 1, kekX, 0, xLen);
|
System.arraycopy(keyEncryptionKey, startPos, kekX, 0, xLen);
|
||||||
|
|
||||||
final byte[] keyEnc = new byte[encryptedSessionKeyMpi[mpiLength + 2]];
|
final byte[] keyEnc = new byte[encryptedSessionKeyMpi[mpiLength + 2]];
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue