Merge branch 'master' into 3.0.0

Author: tomaswolf

sshd-common/src/main/java/org/apache/sshd/common/util/security/eddsa/generic/SignatureEd25519.java

@@ -18,7 +18,9 @@
  */
 package org.apache.sshd.common.util.security.eddsa.generic;
 
+import java.security.SignatureException;
 import java.util.Map;
+import java.util.Objects;
 
 import org.apache.sshd.common.keyprovider.KeyPairProvider;
 import org.apache.sshd.common.session.SessionContext;
@@ -33,6 +35,15 @@
  */
 public class SignatureEd25519 extends AbstractSignature {
 
+    // See https://www.rfc-editor.org/rfc/rfc7748.html#section-4.1
+    // 2^252 + 0x14def9dea2f79cd65812631a5cf5d3ed; little-endian
+    private static final int[] ED25519_ORDER = { //
+            0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, //
+            0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, //
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, //
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10 //
+    };
+
     public SignatureEd25519() {
         super(SecurityUtils.ED25519, KeyPairProvider.SSH_ED25519);
     }
@@ -49,4 +60,34 @@ public boolean verify(SessionContext session, byte[] sig) throws Exception {
 
         return doVerify(data);
     }
+
+    @Override
+    protected boolean doVerify(byte[] data) throws SignatureException {
+        java.security.Signature verifier = Objects.requireNonNull(getSignature(), "Signature not initialized");
+        if (SecurityUtils.EDDSA.equals(verifier.getProvider().getName())) {
+            // Fix CVE 2020-36843 in net.i2p.crypto.eddsa 0.3.0: check that s is in the range [0 .. L), where
+            // L is the order.
+            //
+            // Note: Wikipedia says 0 < S < L. https://en.wikipedia.org/w/index.php?title=EdDSA&oldid=1304068429
+            // RFC 8032 says 0 <= S < L. https://datatracker.ietf.org/doc/html/rfc8032#section-5.1.7
+            //
+            // We stick to RFC 8032 here.
+            if (data.length != 64 || !isValidFactor(data)) {
+                return false;
+            }
+        }
+        return verifier.verify(data);
+    }
+
+    private static boolean isValidFactor(byte[] sig) {
+        // Must be strictly smaller than the field order (little-endian).
+        for (int i = 31; i >= 0; i--) {
+            int y = (sig[i + 32] & 0xFF) - ED25519_ORDER[i];
+            if (y != 0) {
+                return y < 0;
+            }
+        }
+        return false;
+    }
+
 }