Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add verification for deserialized outputs #495

Open
3 tasks
marsella opened this issue Sep 14, 2023 · 0 comments
Open
3 tasks

Add verification for deserialized outputs #495

marsella opened this issue Sep 14, 2023 · 0 comments
Labels
security Security or input validation issue

Comments

@marsella
Copy link

Presign, signing, and interactive signing all take outputs from other protocols as input. In the expected usage of the library, a node running computations will receive protocol output, encrypt it, and stick it in a database, then retrieve, reconstruct, and use it as necessary. There's a possibility that the outputs will get (intentionally or otherwise) corrupted in this process.

All the output types should have some verification on deserialization that they're still correct. For example, auxinfo output contains a modulus and a set of ring-Pedersen parameters; the ring-Pedersen modulus should match the stand-alone modulus. There are likely other properties on the other outputs.

Note: this issue should be broken into multiple, maybe one for each type.

  • Identify properties that must hold for all instances of a type
  • Add some validation method to check this on deserialization (check Verify cryptographic types on deserialization #6 for the latest plan?)
  • Add unit tests (manually creating invalid types, then asserting that serializing + deserializing them fails)
@marsella marsella added the security Security or input validation issue label Sep 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security Security or input validation issue
Projects
None yet
Development

No branches or pull requests

1 participant