Skip to content
Request an audit

‹ All findings

RsaVerifyOptimized::pkcs1Sha256() modified the original code incorrectly in one instance

MediumKeyring Credentials·Three Sigma · Zero-knowledge compliance · 10th July, 20243S-Keyring-M02

ReportSource

Description

RsaVerifyOptimized::pkcs1Sha256() code has slight changes to the original code.

There is one modification that is different from the original, which is checking if the first bytes of decipher are 0x00 and 0x01, respectively.

As can be seen in the following code snippet, the first 2 bytes of decipher may be for example 0x0101 and it will not set the result to false.

solidity
// if (decipher[0] != 0 || decipher[1] != 0x01) {
    // return false;
    // }
if iszero(and(mload(add(decipher, 32)), 0x0001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff)) {
    result := false
}

Additionally, here should be 111, but the code is not reachable as it only accepts digestAlgoWithParamLen == 17 == sha256ExplicitNullParamByteLen.

Recommendation

Use the previous optimized assembly code.

Status

Addressed in #02b0fa2.