CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/10/31 02:22:57
Modified files:
usr.bin/signify: zsig.c
Log message:
signify: check last block size for gzip
The gzip header contains a blocksize extended header. This patch adds the
parsing of an extra lastblocksize header. As the name indicates, this marks
the end of the recorded SHA512/256 blocks and allows checking the size of
the signed data. Once its presence is enforced, this will prevent length
extension attacks. While no such attack for SHA512/256 is known or even
expected to exist, having a tighter form is desirable anyway.
This header not yet emitted and the parser treats it as optional to allow
transitioning. In follow up steps the lastblock will be emitted on signing
and then its presence will be required.
looked over by op
from espie
