Comments (9)
Thank you for your kind words. How did you generate that secret key?
from tweetnacl-js.
In some Java code shown below, where username = "Freddy" and password = "password", hash is the SHA256 of the UTF-8 bytes of its argument, and the true argument to TweetNaCl means it doesn't randomise the input. This is using my own Java port of tweetNaCl:
byte[] hash = hash(username+password);
byte[] publicSigningKey = new byte[32];
byte[] secretSigningKey = new byte[64];
Random r = new Random(Arrays.hashCode(hash));
r.nextBytes(secretSigningKey); // only 32 are used
TweetNaCl.crypto_sign_keypair(publicSigningKey, secretSigningKey, true);
from tweetnacl-js.
Looks like you want nacl.sign.keyPair.fromSeed
instead of nacl.sign.keyPair.fromSecretKey
:
https://jsfiddle.net/p0028d2b/1/
Edit: wait, that will obviously produce a different public key. I'll check with C implementation.
from tweetnacl-js.
I definitely mean fromSecretKey, that should be a valid secret key.
from tweetnacl-js.
Here's a program that signs and tries to open using your provided keys and tweetnacl.c
:
#include <err.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include "tweetnacl.h"
void
randombytes(unsigned char *x, long long y)
{
errx(1, "we don't use randombytes");
}
int
main(int argc, const char **argv)
{
const unsigned char sk[] = {23, 249, 212, 165, 37, 77, 20, 99, 245, 125, 21, 161,
134, 14, 203, 177, 161, 121, 148, 140, 17, 253, 164, 181, 122,
238, 52, 160, 77, 134, 7, 204, 187, 166, 193, 191, 27, 254, 243,
35, 38, 131, 8, 105, 17, 140, 145, 61, 151, 216, 75, 255, 27,
37, 59, 116, 167, 214, 87, 103, 56, 123, 63, 227};
unsigned char m[] = {1,2,3,4,5,6,7,8,9,10,11};
unsigned long long mlen = sizeof(m);
unsigned long long smlen;
unsigned char sm[sizeof(m) + crypto_sign_BYTES];
unsigned char om[sizeof(m)];
crypto_sign(sm, &smlen, m, mlen, sk);
printf("%d", crypto_sign_open(om, &mlen, sm, smlen, &sk[32]));
return 0;
}
It returns -1, meaning it also can't open the signature. Are you sure there are no bugs in key generation of your port?
from tweetnacl-js.
That seems pretty conclusive. I will dig deeper on my end. Sorry for wasting your time.
from tweetnacl-js.
No problem!
from tweetnacl-js.
Just for anyone else who wants to use this C code, the om declaration line needs to be:
unsigned char om[sizeof(m) + crypto_sign_BYTES];
otherwise it always returns -1. (although it does anyway for this example)
from tweetnacl-js.
@ianopolous oops, thanks for checking it. I should have made the test try the correct key too.
from tweetnacl-js.
Related Issues (20)
- Please also export "pack" function in nacl.lowlevel HOT 2
- Box keypair from seed? HOT 2
- Public-key authenticated encryption (box) without authentication HOT 1
- Generating keypair leaks memory HOT 9
- setPRNG HOT 4
- nacl.sign.keyPair & nacl.box.keyPair have inconsistent pubkey HOT 6
- How to use ed25519 secret key in php (Should I convert it to to PEM/OpenSSH compatible format?) HOT 4
- How to add public keys (EC points)? HOT 6
- Hierarchical Deterministic (HD) style extended keys HOT 1
- Support Ed25519ph (HashEdDSA) RFC 8032 Section 5 HOT 2
- Converting ed25519 keys from elliptic lib
- Security vulnerability: nacl.sign.detached accepts invalid keys HOT 8
- no PRNG in react-native HOT 1
- ed25519 verification is malleable and accepts forged signatures HOT 7
- tweetnacl for signal protocol keypairs?
- decrypt with box always return null HOT 1
- This package is unlicensed HOT 1
- Licensing library under MIT HOT 1
- 2.0 or something revamped? HOT 1
- Improve Readability of Code Snippets in README HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from tweetnacl-js.