keygen: fix over-stripping of ED25519 public key bytes

parseDERs() removed *all* leading 0x00 bytes from the ED25519
SubjectPublicKeyInfo BIT STRING content instead of exactly the one
mandatory 'unused bits' marker byte. Whenever the raw 32-byte public
key itself happened to start with 0x00 (~1/256 keys), the loop
over-stripped real key material, producing a truncated key that
parseKey() then correctly rejected as 'Malformed OpenSSH public key'.

Fixes #1514.

Author: Alex C

lib/keygen.js

@@ -289,11 +289,13 @@ function parseDERs(keyType, pub, priv) {
 
       let pubBin = reader.readString(Ber.BitString, true);
       {
-        // Remove leading zero bytes
-        let i = 0;
-        for (; i < pubBin.length && pubBin[i] === 0x00; ++i);
-        if (i > 0)
-          pubBin = pubBin.slice(i);
+        // The BIT STRING content is exactly one "unused bits" count byte
+        // (always 0x00 here, since an ED25519 key is byte-aligned) followed
+        // by the raw 32-byte public key. Strip exactly that one byte --
+        // NOT a variable-length run of zero bytes (the raw key itself can
+        // legitimately start with 0x00).
+        if (pubBin.length > 0 && pubBin[0] === 0x00)
+          pubBin = pubBin.slice(1);
       }
 
       // Parse private key