Changeset 63397

Timestamp:

08/29/2026 06:23:22 PM (7 days ago)

Author:

SergeyBiryukov

Message:

Upgrade/Install: Update sodium_compat to v1.24.1.

The latest version includes a fix for Ed25519 main subgroup validation.

References:

• ​sodium_compat 1.24.1 release notes
• ​Full list of changes in sodium_compat 1.24.1

Developed in ​https://github.com/WordPress/wordpress-develop/pull/13290.

Follow-up to r55699, r58752, r58753, r60787, r60905, r61419.

Props paragoninitiativeenterprises, wprashed, SergeyBiryukov.
Fixes #65903.

Location:

trunk/src/wp-includes/sodium_compat/src

Files:

• Core/Curve25519.php (modified) (1 diff)
• Core/Ed25519.php (modified) (1 diff)
• Core32/Curve25519.php (modified) (1 diff)
• Core32/Ed25519.php (modified) (3 diffs)
• File.php (modified) (1 diff)

trunk/src/wp-includes/sodium_compat/src/Core/Curve25519.php

@@ -2900 +2900 @@
                 $t = self::ge_sub($u, $Ai[(int)(-$aslide[$i] / 2)]);
             }
+            $r = self::ge_p1p1_to_p3($t);
         }
 

trunk/src/wp-includes/sodium_compat/src/Core/Ed25519.php

@@ -120 +120 @@
         $p1 = self::ge_mul_l($A);
         $t = self::fe_sub($p1->Y, $p1->Z);
-        return self::fe_isnonzero($p1->X) && self::fe_isnonzero($t);
+        return !self::fe_isnonzero($p1->X) && !self::fe_isnonzero($t);
     }
 

trunk/src/wp-includes/sodium_compat/src/Core32/Curve25519.php

@@ -3155 +3155 @@
                 $t = self::ge_sub($u, $Ai[(int)(-$aslide[$i] / 2)]);
             }
+            $r = self::ge_p1p1_to_p3($t);
         }
         # ge_p1p1_to_p3(r, &t);

trunk/src/wp-includes/sodium_compat/src/Core32/Ed25519.php

@@ -108 +108 @@
 
     /**
+     * Returns TRUE if $A represents a point on the order of the Edwards25519 prime order subgroup.
+     * Returns FALSE if $A is on a different subgroup.
+     *
+     * @param ParagonIE_Sodium_Core32_Curve25519_Ge_P3 $A
+     * @return bool
+     *
+     * @throws SodiumException
+     */
+    public static function is_on_main_subgroup(ParagonIE_Sodium_Core32_Curve25519_Ge_P3 $A)
+    {
+        $p1 = self::ge_mul_l($A);
+        $t = self::fe_sub($p1->Y, $p1->Z);
+        return !self::fe_isnonzero($p1->X) && !self::fe_isnonzero($t);
+    }
+
+    /**
      * @param string $pk
      * @return string
@@ -119 +135 @@
         }
         $A = self::ge_frombytes_negate_vartime($pk);
-        $p1 = self::ge_mul_l($A);
-        if (!self::fe_isnonzero($p1->X)) {
-            throw new SodiumException('Unexpected zero result');
+        if (!self::is_on_main_subgroup($A)) {
+            throw new SodiumException('Public key is not on a member of the main subgroup');
         }
 
@@ -308 +323 @@
         /** @var ParagonIE_Sodium_Core32_Curve25519_Ge_P3 $A */
         $A = self::ge_frombytes_negate_vartime($pk);
+        if (!self::is_on_main_subgroup($A)) {
+            throw new SodiumException('Public key is not on a member of the main subgroup');
+        }
 
         /** @var string $hDigest */

trunk/src/wp-includes/sodium_compat/src/File.php

@@ -1330 +1330 @@
         ParagonIE_Sodium_Compat::$fastMult = true;
 
+        if (ParagonIE_Sodium_Core32_Ed25519::small_order($publicKey)) {
+            throw new SodiumException('Public key has small order');
+        }
         /** @var ParagonIE_Sodium_Core32_Curve25519_Ge_P3 $A */
         $A = ParagonIE_Sodium_Core32_Ed25519::ge_frombytes_negate_vartime($publicKey);
+        if (!ParagonIE_Sodium_Core32_Ed25519::is_on_main_subgroup($A)) {
+            throw new SodiumException('Public key is not on a member of the main subgroup');
+        }
 
         $hs = hash_init('sha512');