quantus/common
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Add input length validation in scryptFromU8a function (#1990)

Browse Source 
* fix: add input length validation in scryptFromU8a function

* fix: improve input validation in scryptFromU8a function

* fix: linting

* fix: update default Scrypt parameters for improved security

* revert: 9070615

* fix: remove dymanic calculation
This commit is contained in:
Arjun Porwal
2025-06-13 10:16:25 -03:00
committed by GitHub
parent 2bc18cfdbb
commit 43ac361806
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/util-crypto/src/scrypt/fromU8a.ts
+12 -3
View File
@@ -14,10 +14,19 @@ interface Result {
}
export function scryptFromU8a (data: Uint8Array): Result {
if (!(data instanceof Uint8Array)) {
throw new Error('Expected input to be a Uint8Array');
}
// Ensure the input is exactly 44 bytes: 32 for salt + 3 * 4 for N, p, r
if (data.length < 32 + 12) {
throw new Error(`Invalid input length: expected 44 bytes, found ${data.length}`);
}
const salt = data.subarray(0, 32);
const N = u8aToBn(data.subarray(32 + 0, 32 + 4), BN_LE_OPTS).toNumber();
const p = u8aToBn(data.subarray(32 + 4, 32 + 8), BN_LE_OPTS).toNumber();
const r = u8aToBn(data.subarray(32 + 8, 32 + 12), BN_LE_OPTS).toNumber();
const N = u8aToBn(data.subarray(32, 36), BN_LE_OPTS).toNumber();
const p = u8aToBn(data.subarray(36, 40), BN_LE_OPTS).toNumber();
const r = u8aToBn(data.subarray(40, 44), BN_LE_OPTS).toNumber();
// FIXME At this moment we assume these to be fixed params, this is not a great idea
// since we lose flexibility and updates for greater security. However we need some