Skip to content

Comments

EC check key on cofactor > 1#14287

Merged
alex merged 8 commits intopyca:46.0.xfrom
reaperhulk:46-ec-check
Feb 10, 2026
Merged

EC check key on cofactor > 1#14287
alex merged 8 commits intopyca:46.0.xfrom
reaperhulk:46-ec-check

Conversation

@reaperhulk
Copy link
Member

No description provided.

alex and others added 4 commits February 10, 2026 09:08
This only applies to the binary curves (ed25519 is cofactor 8 and
ed448 is cofactor 4 but we use a different code path for eddsa)
}
}

fn cofactor_check(group: &openssl::ec::EcGroupRef) -> CryptographyResult<bool> {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is a terrible name tbh. I don't see why you wouldn't just inline this into the caller either?

let mut cofactor = openssl::bn::BigNum::new()?;
group.cofactor(&mut cofactor, &mut bn_ctx)?;
let one = openssl::bn::BigNum::from_u32(1)?;
Ok(cofactor.ucmp(&one) == std::cmp::Ordering::Greater)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you can just do cofactor == one

CHANGELOG.rst Outdated
~~~~~~~~~~~~~~~~~~~

* Support for ``SECT*`` elliptic curves is deprecated and will be removed in
the next release.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to document the fix here.

@alex alex enabled auto-merge (squash) February 10, 2026 18:30
@alex alex merged commit 0eebb9d into pyca:46.0.x Feb 10, 2026
73 checks passed
@reaperhulk reaperhulk deleted the 46-ec-check branch February 10, 2026 18:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants