[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #33545 [Core Tor/Tor]: assertion failure when "all zero" client auth key provided
#33545: assertion failure when "all zero" client auth key provided
--------------------------+----------------------------------------
Reporter: mcs | Owner: (none)
Type: defect | Status: closed
Priority: High | Milestone: Tor: 0.4.3.x-final
Component: Core Tor/Tor | Version: Tor: 0.4.4.0-alpha-dev
Severity: Normal | Resolution: duplicate
Keywords: 043-should | Actual Points:
Parent ID: | Points:
Reviewer: asn | Sponsor:
--------------------------+----------------------------------------
Comment (by cypherpunks):
Replying to [comment:6 asn]:
> Many thanks for the fix branch. The branch we merged as part of #33137
is equivalent.
What part of the commits to fix #33137 is equivalent to the branch in this
ticket, exactly? They cover entirely different codepaths.
The #33137 investigation into fixing faulty keys passed with `ADD_ONION`
explicitly reached the conclusion that faulty keys passed to
`ONION_CLIENT_AUTH_ADD` aren't even a problem that needs to be fixed. This
ticket was filed to say those actually are an issue that needs to be
fixed.
{{{
in the HSv3 client authorization feature we can get an x25519
privkey from the control port through the ONION_CLIENT_AUTH_ADD command
(in
handle_control_onion_client_auth_add()). However, we never convert that
key
to a pubkey, as it always lives in hs_client_service_authorization_t as
a
secret key. Also, when we actually do use that secret key in
build_descriptor_cookie_keys() the x25519 module is responsible for
doing the
necessary tweaks to make it well formed (see how curve25519_donna() does
the
necessary bit transformations on the 'secret' key).
}}}
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/33545#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs