spake2 0.4.0 → 0.4.1

raw patch · 3 files changed

+7/−3 lines, 3 files

Files

CHANGELOG.md +5/−0
spake2.cabal +1/−1
src/Crypto/Spake2/Groups/Ed25519.hs +1/−2

CHANGELOG.md view

@@ -1,5 +1,10 @@ # Changelog +## 0.4.1 (2018-01-17)++* Fixed potential security issue in `Ed25519` (see https://github.com/jml/haskell-spake2/pull/16),+  present since initial release. Please update as soon as possible.+ ## 0.4.0 (2017-11-22)  * Change `createSessionKey` inputs to be `inbound`, `outbound` rather than

spake2.cabal view

@@ -3,7 +3,7 @@ -- see: https://github.com/sol/hpack  name:           spake2-version:        0.4.0+version:        0.4.1 synopsis:       Implementation of the SPAKE2 Password-Authenticated Key Exchange algorithm description:    This library implements the SPAKE2 password-authenticated key exchange                 ("PAKE") algorithm. This allows two parties, who share a weak password, to

src/Crypto/Spake2/Groups/Ed25519.hs view

@@ -18,7 +18,7 @@   , generator   ) where -import Protolude hiding (group, zero)+import Protolude hiding (group)  import Crypto.Error (CryptoFailable(..), CryptoError(..)) import Crypto.Number.Generate (generateMax)@@ -301,7 +301,6 @@ scalarMultiplyExtendedPoint :: (ExtendedPoint a -> ExtendedPoint a -> ExtendedPoint a) -> Integer -> ExtendedPoint a -> ExtendedPoint a scalarMultiplyExtendedPoint _ 0 _    = extendedZero scalarMultiplyExtendedPoint add n x-  | n >= l    = scalarMultiplyExtendedPoint add (n `mod` l) x   | even n    = doubleExtendedPoint (scalarMultiplyExtendedPoint add (n `div` 2) x)   | n == 1    = x   | n <= 0    = panic $ "Unexpected negative multiplier: " <> show n