Re: Bug in SIG(0) signature generation in 2.1.5

[Tekto <te...@ge...>]

Hi Brian,

On 07/26/2013 09:06 PM, Brian Wellington wrote:>
 >
 > I assume there's some missing code between the signMessage and 
verifyMessage?
 > Passing the same Message object to both signMessage and verifyMessage
 > doesn't work, since some of the internal Message state needed to
 > verify is only filled in when the Message is parsed from wire format;
 > that is, something like:

Yes, you're right. I'd tried misc. thing to fiddle that out (including 
injecting captured requests with nsupdate) so I didn't remember
for sure the last steps.

 > SIG0.signMessage(updateMessage, keyRecord, privKey, null);
 > byte [] wire = msg.toWire();
 > Message msg = new Message(wire);
 > SIG0.verifyMessage(msg, msg.toWire(), keyRecord, null);
 >
 > Without that, the code throws an ArrayIndexOutOfBoundsException, 
because it's badly handling the fact that the Message doesn't know where 
the start of the SIG0 record is (I've locally updated the code to throw 
a more useful NoSignatureException).
 >
 > With code like that added, I'm seeing the failure, although I'm not 
sure why I'm not seeing the same failure in the existing SIG0 test code 
I have.
 >
 > I'm going to try and adapt this sample code into a unit test, and 
commit the changes in the next few days.

If you like, I can send you the test-key and host a used.

 >
 > Thanks!
 >
 > Brian
 >

Bye, Adam