Skip to content

BLS secret key validation is missing #96

Open

Description

@dnkolegov

Describe the bug
The BLS spec requires that the secret key (SK) must be a uniformly random integer such that 1 <= SK < r.
Where r is the order curve.

The last check is missing:

Expected behavior

Check that the provided SK < r.

Activity

  1. dapplion commented on Jun 3, 2021

    @dapplion
    Contributor

    Thanks for looking into this! I think BLST takes care of that, but it would be good to add a test. Transfering to bls repo.

  2. transferred this issue fromChainSafe/lodestaron Jun 3, 2021
  3. dnkolegov commented on Jun 3, 2021

    @dnkolegov
    Author

    The following test for SK = q+1 will pass and will not raise an exception.

    describe("q+1 secret key", () => {
        const qHex = fromHex("73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000002");
        const sk = bls.SecretKey.fromBytes(qHex);
        const msg = Buffer.from("sample-msg");
        const sig = sk.sign(msg);
        const pk = sk.toPublicKey();
        console.log(pk.toBytes())
        it("verify", () => {
          const valid = bls.verify(msg, pk, sig);
          expect(valid).to.equal(true);
        });
        
     });
    
  4. dapplion commented on Jun 3, 2021

    @dapplion
    Contributor

    Feel free to do a PR with the test and a fix if you want! I can do the latter if you need help.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Fields

    Priority

    None yet

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions