@amritk/nish-x86_64-linux 0.14.0 → 0.16.0

package/std/crypto/ct.ts

@@ -23,12 +23,18 @@
  *
  * Arrays of different lengths answer `false` at once, because a length is
  * public; arrays of one length are compared in full, with no early exit.
+ *
+ * The lengths are compared as the `number`s they are, before any `toI32`:
+ * under `--number-mode f64` `toI32` saturates at 2^31 - 1, so two arrays past
+ * it would have looked the same length and been compared only that far. An
+ * array longer than that answers `false` too — no `i32` index reaches its end,
+ * and a compare that cannot read every byte must not say "equal".
  */
 export const timingSafeEqual = (a: u8[], b: u8[]): boolean => {
-  const n: i32 = toI32(a.length)
-  if (n !== toI32(b.length)) {
+  if (a.length !== b.length || a.length > 2147483647) {
     return false
   }
+  const n: i32 = toI32(a.length)
   let diff: i32 = 0
   // Bounded by both lengths, which are equal here, so the prover drops both
   // bounds checks rather than trusting the comparison above.

package/std/crypto/hkdf.ts

@@ -16,7 +16,11 @@
  * The counter `i` is one byte, so `L` is at most 255 × HashLen (§2.3): 8160
  * bytes for SHA-256 and 12240 for SHA-384. A longer `L`, or a negative one,
  * answers `null` rather than panicking, because `L` usually comes from a
- * protocol field; `L = 0` answers an empty array.
+ * protocol field; `L = 0` answers an empty array. So does an `info` longer
+ * than 2^31 - 1 bytes, which `toI32` would cut to a prefix under
+ * `--number-mode f64`, so that two `info`s sharing it gave one key, and a PRK
+ * shorter than HashLen, which §2.3 does not allow: an empty one is a key
+ * anybody can compute with.
  *
  * HKDF-Expand-Label, TLS 1.3's wrapper around `expand`, belongs with TLS and is
  * not here. Written from RFC 5869, not ported from another implementation.
@@ -64,10 +68,16 @@ export const hkdfExtractSha384 = (salt: u8[], ikm: u8[]): u8[] => hmacSha384(hkd
 /**
  * HKDF-Expand with HMAC-SHA-256 (RFC 5869 §2.3): `length` bytes of output
  * keying material from `prk` and `info`, or `null` when `length` is negative
- * or past 255 × 32.
+ * or past 255 × 32, when `info` is longer than 2^31 - 1 bytes, or when `prk`
+ * is shorter than 32 bytes.
  */
 export const hkdfExpandSha256 = (prk: u8[], info: u8[], length: i32): u8[] | null => {
-  if (length < 0 || length > HKDF_MAX_BLOCKS * SHA256_SIZE) {
+  if (
+    length < 0 ||
+    length > HKDF_MAX_BLOCKS * SHA256_SIZE ||
+    info.length > 2147483647 ||
+    toI32(prk.length) < SHA256_SIZE
+  ) {
     return null
   }
   const out: u8[] = new Array<u8>(length)
@@ -92,10 +102,16 @@ export const hkdfExpandSha256 = (prk: u8[], info: u8[], length: i32): u8[] | nul
 /**
  * HKDF-Expand with HMAC-SHA-384 (RFC 5869 §2.3): `length` bytes of output
  * keying material from `prk` and `info`, or `null` when `length` is negative
- * or past 255 × 48.
+ * or past 255 × 48, when `info` is longer than 2^31 - 1 bytes, or when `prk`
+ * is shorter than 48 bytes.
  */
 export const hkdfExpandSha384 = (prk: u8[], info: u8[], length: i32): u8[] | null => {
-  if (length < 0 || length > HKDF_MAX_BLOCKS * SHA384_SIZE) {
+  if (
+    length < 0 ||
+    length > HKDF_MAX_BLOCKS * SHA384_SIZE ||
+    info.length > 2147483647 ||
+    toI32(prk.length) < SHA384_SIZE
+  ) {
     return null
   }
   const out: u8[] = new Array<u8>(length)

package/std/crypto/hmac.ts

@@ -127,15 +127,31 @@ export class HmacSha384 {
   }
 }
 
-/** The HMAC-SHA-256 of all of `data` under `key`, as a fresh 32-byte array. */
+/**
+ * The HMAC-SHA-256 of all of `data` under `key`, as a fresh 32-byte array.
+ *
+ * `data` longer than 2^31 - 1 bytes panics, as `sha256` does and for its
+ * reason: under `--number-mode f64` the tag would be of a prefix, and a tag
+ * that verifies every message sharing that prefix is a forgery. A key that
+ * long reaches `sha256` in the constructor and panics there.
+ */
 export const hmacSha256 = (key: u8[], data: u8[]): u8[] => {
+  if (data.length > 2147483647) {
+    panic("hmacSha256: a message longer than 2^31 - 1 bytes")
+  }
   const mac = new HmacSha256(key)
   mac.update(data, HMAC_FROM, toI32(data.length))
   return mac.digest()
 }
 
-/** The HMAC-SHA-384 of all of `data` under `key`, as a fresh 48-byte array. */
+/**
+ * The HMAC-SHA-384 of all of `data` under `key`, as a fresh 48-byte array.
+ * `data` longer than 2^31 - 1 bytes panics, as in `hmacSha256`.
+ */
 export const hmacSha384 = (key: u8[], data: u8[]): u8[] => {
+  if (data.length > 2147483647) {
+    panic("hmacSha384: a message longer than 2^31 - 1 bytes")
+  }
   const mac = new HmacSha384(key)
   mac.update(data, HMAC_FROM, toI32(data.length))
   return mac.digest()