From 589a3a6729b36f9aea375aff0bb584f1eeb6c666 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 12 Jun 2026 17:44:55 +0200 Subject: [PATCH] curve25519: Reject all-zero shared secrets While RFC 7748 states implementations MAY perform such a check, e.g. TLS 1.3 explicitly requires it (RFC 8446, section 7.4.2). Fixes: 7f9bfacd5a51 ("curve25519: Add a plugin providing Curve25519 DH using backend drivers") --- .../plugins/curve25519/curve25519_dh.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/libstrongswan/plugins/curve25519/curve25519_dh.c b/src/libstrongswan/plugins/curve25519/curve25519_dh.c index f39ff2876..85213b7a6 100644 --- a/src/libstrongswan/plugins/curve25519/curve25519_dh.c +++ b/src/libstrongswan/plugins/curve25519/curve25519_dh.c @@ -120,12 +120,19 @@ METHOD(key_exchange_t, set_seed, bool, METHOD(key_exchange_t, get_shared_secret, bool, private_curve25519_dh_t *this, chunk_t *secret) { - if (!this->computed && - !this->drv->curve25519(this->drv, this->pubkey, this->shared)) + if (!this->computed) { - return FALSE; + if (!this->drv->curve25519(this->drv, this->pubkey, this->shared)) + { + return FALSE; + } + if (memeq_const(this->shared, (u_char[CURVE25519_KEY_SIZE]){0}, + CURVE25519_KEY_SIZE)) + { + return FALSE; + } + this->computed = TRUE; } - this->computed = TRUE; *secret = chunk_clone(chunk_from_thing(this->shared)); return TRUE; }