Comment on Psychic Signatures in JavaComments−bertman4yThe fix for OpenJDK (authored on Jan. 4th 22):https://github.com/openjdk/jdk/blob/e2f8ce9c3ff4518e070960ba...−drexlspivey4ywith commit message “Improve ECDSA signature support” :D−baobabKoodaa4yI'm guessing the commit message is obscured to give people more time to update before it's exploited in the wild.−sdhfkjwefs4yWhy are there no tests?−MrBuddyCasino4yI spot no test or comment in the code on why this assertion is important.−bertman4yIt's literally what the whole bug is about. From OP's article:This is why the very first check in the ECDSA verification algorithm is to ensure that r and s are both >= 1. Guess which check Java forgot?−MrBuddyCasino4yYes I just think it’s insane they fixed it without adding a test or comment.
Comments
The fix for OpenJDK (authored on Jan. 4th 22):
https://github.com/openjdk/jdk/blob/e2f8ce9c3ff4518e070960ba...
with commit message “Improve ECDSA signature support” :D
I'm guessing the commit message is obscured to give people more time to update before it's exploited in the wild.
Why are there no tests?
I spot no test or comment in the code on why this assertion is important.
It's literally what the whole bug is about. From OP's article:
Yes I just think it’s insane they fixed it without adding a test or comment.