Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

strange private keys #21

Open
alanesmizi opened this issue Jun 5, 2023 · 0 comments
Open

strange private keys #21

alanesmizi opened this issue Jun 5, 2023 · 0 comments

Comments

@alanesmizi
Copy link

alanesmizi commented Jun 5, 2023

I am importing these crates
curve25519-dalek-ng = "4.1.1"
x25519-dalek = "1.1.0"

And I am generating a Curve25519 private key from a Ed25519 private key with the following code:
// Obtain the secret point from the Private Key Ed25519 of 64 bytes
let secret_key_point: EdwardsPoint = &secret_key_scalar * &ED25519_BASEPOINT_POINT;

// Generate the X25519 key pair from the Private Key Ed25519
let curve25519_private_key_montgomery = secret_key_point.to_montgomery();

But now I have an issue, when I create a StaticSecret, for example as:

let curve25519_private_key_ss = StaticSecret::from(curve25519_private_key_array);

I get a different result depending on how many times I run it

private_key = x25519::StaticSecret::from(self.config.cgrodt_private_key);

self.config.cgrodt_private_key and curve25519_private_key_array having the same value, produce different private keys.

Now, this obviously should not happen but on top, to give you an example, these two private keys are generated:

0HloxiLX/gYf2s3WLlkPibiU4NuSK1C6otJsoNNfo3o=
1XloxiLX/gYf2s3WLlkPibiU4NuSK1C6otJsoNNfozo=

If you convert this to Hex and then to ASCII you get

olxEyeMlittle-alpha-word

and

myellite-alpha-word

Neither look very random to me.

I am under the impression either the code is compromised or the crate is compromised.

Any ideas?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant