Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Empty logs sign wrong root hash #14

Closed
mcpherrinm opened this issue Mar 18, 2024 · 2 comments
Closed

Empty logs sign wrong root hash #14

mcpherrinm opened this issue Mar 18, 2024 · 2 comments

Comments

@mcpherrinm
Copy link
Contributor

Per @AGWA on https://groups.google.com/a/chromium.org/g/ct-policy/c/v9JzlbphYBs/m/-blS5vMtAgAJ

Note that all cryptographic operations (such as hashes and signatures)
are as specified by RFC 6962, so these APIs can be thought of as an
alternative encoding format for the same data

at least 10 Sunlight logs have produced STHs with a tree size of 0 and an all-zero root hash, while RFC 6962 specifies that the root hash of an empty tree is the SHA-256 hash of an empty string.

@nholstein
Copy link

@mcpherrinm, are you looking for help with this? If so, I see two approaches:

  1. fixup the hash of an empty tree prior to calling signTreeHead
  2. copy and patch the logic of tlog.TreeHash to handle empty trees

The second approach would also need to handle construction of a new log within ctlog.CreateLog, so it seems like the first approach is simpler.

Would a PR be helpful?

@FiloSottile
Copy link
Owner

I had a chat with Russ, and we're going to change golang.org/x/mod/sumdb/tlog upstream, to avoid ecosystem fragmentation on this.

FiloSottile added a commit that referenced this issue Jun 5, 2024
gopherbot pushed a commit to golang/mod that referenced this issue Jun 26, 2024
Updates FiloSottile/sunlight#14

Change-Id: I712ea53fd3a17b66ec310d8f48de44416d0054cc
Reviewed-on: https://go-review.googlesource.com/c/mod/+/590715
Reviewed-by: Russ Cox <[email protected]>
Auto-Submit: Filippo Valsorda <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
Reviewed-by: Joedian Reid <[email protected]>
FiloSottile added a commit that referenced this issue Jul 18, 2024
FiloSottile added a commit that referenced this issue Jul 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants