Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sign interprets message as hex even when it's not hex #56

Closed
clark800 opened this issue Oct 14, 2015 · 5 comments
Closed

sign interprets message as hex even when it's not hex #56

clark800 opened this issue Oct 14, 2015 · 5 comments

Comments

@clark800
Copy link

The toArray function strips non-hex characters without warning. If a user tries to pass a UTF8 string as the message, they may assume that it is signing the string message and not realize that the message is being interpreted as hex with non-hex characters stripped. It would be more defensive to throw an exception here:

https://github.com/indutny/elliptic/blob/master/lib/elliptic/utils.js#L33
https://github.com/indutny/elliptic/blob/master/lib/elliptic/utils.js#L164

@indutny
Copy link
Owner

indutny commented Oct 14, 2015

I think this makes sense. Could you be interested in submitting the fix for this?

@fanatid
Copy link
Contributor

fanatid commented Nov 6, 2016

Should note, that this problem not only in elliptic.. hash.js and maybe other libraries.

@dcousens
Copy link

dcousens commented Nov 7, 2016

Again, one of the scariest parts of the elliptic suite is the non-strict typing [for me].
I trust the math, but not JS.

@dcousens
Copy link

dcousens commented Nov 7, 2016

Perhaps close in favour of #105, otherwise, related

@indutny indutny closed this as completed Nov 7, 2016
@indutny
Copy link
Owner

indutny commented Nov 7, 2016

Agree.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants