Sanitize x25519 public keys

[bellebaum]

According to Section 5 of RFC 7748, bit 255 should be ignored when parsing u-coordinates. I cannot find this check, which may result in the constant-time addition on f25519 taking a wrong choice about reducing modulo 2^255-19. Have I missed something?

[DavyLandman]

For context: this repo is not meant to implement a specific RFC (it does not mention 7748). For example RFC8032 is also something to consider.

In the readme it points to the source of this implementation: https://www.dlbeer.co.nz/oss/c25519.html

And in the bottom it has a section on RFC compliance:

RFC7748

RFC7748 requires that C25519 public keys whose X coordinate is greater than the prime-field modulus first be reduced modulo 2^255. This can be implemented simply by applying a mask to the last byte of a public key before trying to use it:

public[31] &= ~0x7f;

is that what you're referring too?

I would be open to accepting a PR that adds 2 extra functions (or perhaps preprocessor definitions) that add support for RFC7748 and RFC8032.

[bellebaum]

Right, that is what I missed. Thanks :)

I might open a PR eventually. For now I have a different solution.
If someone else should open a PR first: Be aware that if public keys are hashed together with the shared DH-secret, the hash needs to include the public keys as found on the wire, i.e. not sanitized, to avoid some subtle vulnerabilities.