Solution for ECDSA and EDDSA Signature Verification Problems

Description

Problems have been identified in the verification of ECDSA and EDDSA signatures in the Wycheproof project. Missing checks during the signature decoding stage allow adding or removing zero bytes, which affects the ability to send emails. This update in the signature.js file fixes these problems by verifying the signature length.

Installation

1. Clone the repository:
   root@kitploit:~

   git clone https://github.com/tu_usuario/tu_repositorio.git
   

2. Navigate to the project directory: cd tu_repositorio
3. Install the dependencies: npm install Usage
4. Import the elliptic library: var elliptic = require('elliptic'); var eddsa = elliptic.eddsa; var ec = new elliptic.ec('secp256k1')
5. Load the public key and verify the signatures: var ed25519 = new eddsa('ed25519'); var key = ed25519.keyFromPublic('7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa', 'hex');

// EDDSA signature verification var msg = '54657374'; var sig = '7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d00'; console.log(key.verify(msg, sig));

// ECDSA signature verification var hash = require('hash.js'); var toArray = elliptic.utils.toArray; var hashMsg = hash.sha256().update(toArray(msg, 'hex')).digest(); var pubKey = ec.keyFromPublic('04b838ff44e5bc177bf21189d0766082fc9d843226887fc9760371100b7ee20a6ff0c9d75bfba7b31a6bca1974496eeb56de357071955d83c4b1badaa0b21832e9', 'hex'); console.log('Valid signature: ' + pubKey.verify(hashMsg, sig));