code review 6215074: crypto/ecdsa: hashToInt() mishandles curves with BitLen...

src/pkg/crypto/ecdsa/ecdsa.go

 // Copyright 2011 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
 // Package ecdsa implements the Elliptic Curve Digital Signature Algorithm, as
 // defined in FIPS 186-3.
 package ecdsa
 
 // References:
 //   [NSA]: Suite B implementer's guide to FIPS 186-3,
@@ skipping 52 matching lines @@
         return
 }
 
 // hashToInt converts a hash value to an integer. There is some disagreement
 // about how this is done. [NSA] suggests that this is done in the obvious
 // manner, but [SECG] truncates the hash to the bit-length of the curve order
 // first. We follow [SECG] because that's what OpenSSL does.
 func hashToInt(hash []byte, c elliptic.Curve) *big.Int {
         orderBits := c.Params().N.BitLen()
         orderBytes := (orderBits + 7) / 8
+        var excess int
         if len(hash) > orderBytes {
+                excess = orderBytes*8 - orderBits
                 hash = hash[:orderBytes]
         }
 
         ret := new(big.Int).SetBytes(hash)
-        excess := orderBytes*8 - orderBits
         if excess > 0 {
                 ret.Rsh(ret, uint(excess))
         }
         return ret
 }
 
 // Sign signs an arbitrary length hash (which should be the result of hashing a
 // larger message) using the private key, priv. It returns the signature as a
 // pair of integers. The security of the private key depends on the entropy of
 // rand.
@@ skipping 53 matching lines @@
 
         x1, y1 := c.ScalarBaseMult(u1.Bytes())
         x2, y2 := c.ScalarMult(pub.X, pub.Y, u2.Bytes())
         if x1.Cmp(x2) == 0 {
                 return false
         }
         x, _ := c.Add(x1, y1, x2, y2)
         x.Mod(x, N)
         return x.Cmp(r) == 0
 }