This is an automated email from the ASF dual-hosted git repository. acassis pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 4d843e7d7ec6dde4f98279115962b1a7b17e0793 Author: Daniel P. Carvalho <[email protected]> AuthorDate: Sat Oct 24 17:37:12 2026 -0300 crypto/ecc: fill the whole random buffer with ECC_BYTES. ecc_make_key(), ecc_make_key_uncomp(), ecdh_shared_secret() and ecdsa_sign() passed NUM_ECC_DIGITS (4) as the length to arc4random_buf(), which counts bytes. Only the first 4 of the 32 bytes of the private key, the blinding value and the nonce k were random, and the rest was whatever the buffer held before. Pass ECC_BYTES. Assisted-by: Claude Code:claude-sonnet-5-5 Signed-off-by: Daniel P. Carvalho <[email protected]> --- crypto/ecc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/crypto/ecc.c b/crypto/ecc.c index 6febe788997..c90ae825dea 100644 --- a/crypto/ecc.c +++ b/crypto/ecc.c @@ -1516,7 +1516,7 @@ int ecc_make_key(uint8_t publickey[ECC_BYTES + 1], return 0; } - arc4random_buf(l_private, NUM_ECC_DIGITS); + arc4random_buf(l_private, ECC_BYTES); if (vli_iszero(l_private)) { @@ -1558,7 +1558,7 @@ int ecc_make_key_uncomp(uint8_t publickey_x[ECC_BYTES], return 0; } - arc4random_buf(l_private, NUM_ECC_DIGITS); + arc4random_buf(l_private, ECC_BYTES); if (vli_iszero(l_private)) { @@ -1597,7 +1597,7 @@ int ecdh_shared_secret(const uint8_t publickey[ECC_BYTES + 1], memset(&l_product, 0, sizeof(eccpoint_t)); memset(&l_public, 0, sizeof(eccpoint_t)); - arc4random_buf(l_random, NUM_ECC_DIGITS); + arc4random_buf(l_random, ECC_BYTES); ecc_point_decompress(&l_public, publickey); ecc_bytes2native(l_private, privatekey); @@ -1627,7 +1627,7 @@ int ecdsa_sign(const uint8_t privatekey[ECC_BYTES], return 0; } - arc4random_buf(k, NUM_ECC_DIGITS); + arc4random_buf(k, ECC_BYTES); if (vli_iszero(k)) {
