Ensure ecdsa_sign output is canonically reduced.

* ecc-ecdsa-sign.c (ecc_ecdsa_sign): Ensure s output is reduced to
canonical range.

(cherry picked from commit c24b36160dc5303f7541dd9da1429c4046f27398)

diff --git a/ChangeLog b/ChangeLog
index 63848f538eae7b2d3f2a0fc7d68e3704c605751d..fb2d7f666cad987dc57915e19cd8ed978ecc282a 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2021-03-13  Niels Möller  <nisse@lysator.liu.se>
 
+       * ecc-ecdsa-sign.c (ecc_ecdsa_sign): Ensure s output is reduced to
+       canonical range.
+
        * ecc-ecdsa-verify.c (ecc_ecdsa_verify): Use ecc_mod_mul_canonical
        to compute the scalars used for ecc multiplication.
        * testsuite/ecdsa-verify-test.c (test_main): Add test case that

diff --git a/ecc-ecdsa-sign.c b/ecc-ecdsa-sign.c
index f323196e030f84ba262eae88fea7610612459301..4adee1d1f58e2287a7cc1b57955df672fd93c15a 100644 (file)
--- a/ecc-ecdsa-sign.c
+++ b/ecc-ecdsa-sign.c
@@ -91,9 +91,8 @@ ecc_ecdsa_sign (const struct ecc_curve *ecc,
 
   ecc_mod_mul (&ecc->q, tp, zp, rp, tp);
   ecc_mod_add (&ecc->q, hp, hp, tp);
-  ecc_mod_mul (&ecc->q, tp, hp, kinv, tp);
+  ecc_mod_mul_canonical (&ecc->q, sp, hp, kinv, tp);
 
-  mpn_copyi (sp, tp, ecc->p.size);
 #undef P
 #undef hp
 #undef kinv