Conversation
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| blind := blinds[i] | ||
| if blind == nil || *blind.Group().Params() != *c.params.group.Params() || blind.IsZero() { | ||
| return nil, nil, ErrInvalidInput | ||
| } |
There was a problem hiding this comment.
🟡 New validation rules land without any reference to the standard that requires them
The new rejection of empty and zero blinding values is added (blind.IsZero() at oprf/client.go:55) without any comment or commit-message reference to the specification that mandates it, so reviewers cannot check the rule against the standard.
Impact: Reviewers and future maintainers have no traceable justification for the new rejection rules, which the project checklist requires for every implementation change.
Repository rule requiring a spec citation
REVIEW.md (Correctness section) states: "Implementation cites its spec — RFC, FIPS, IETF draft, or paper (ia.cr/...) — in code comments or commit message." The new validation block at oprf/client.go:54-57 and the identity check at oprf/client.go:64-66 add spec-driven behavior (RFC 9497 requires blinds to be non-zero elements of the suite's scalar field), yet neither the code nor the commit message (oprf: reject invalid deterministic blinds, no body) mentions RFC 9497 or the relevant section.
| blind := blinds[i] | |
| if blind == nil || *blind.Group().Params() != *c.params.group.Params() || blind.IsZero() { | |
| return nil, nil, ErrInvalidInput | |
| } | |
| // RFC 9497, Section 3.3.1 (Blind): the blind must be a non-zero | |
| // scalar of the suite's group, otherwise it cannot be inverted | |
| // during Finalize. | |
| blind := blinds[i] | |
| if blind == nil || *blind.Group().Params() != *c.params.group.Params() || blind.IsZero() { | |
| return nil, nil, ErrInvalidInput | |
| } |
Was this helpful? React with 👍 or 👎 to provide feedback.
| blind := blinds[i] | ||
| if blind == nil || *blind.Group().Params() != *c.params.group.Params() || blind.IsZero() { | ||
| return nil, nil, ErrInvalidInput | ||
| } |
There was a problem hiding this comment.
🟨 Blind group membership is checked only by comparing element/scalar byte lengths
The new validation accepts a caller-supplied blinding scalar whenever its group's byte-length parameters match the suite's (*blind.Group().Params() != *c.params.group.Params() at oprf/client.go:55), rather than verifying the scalar actually belongs to the suite's group. Any group whose group.Params (element, compressed element, and scalar lengths) coincide with the suite's would pass this check and then be passed into Mul at oprf/client.go:63, where implementations perform a concrete-type assertion and would panic on attacker/caller-supplied data. Today none of the four supported groups share identical parameters, so the check happens to be sufficient, but it is a fragile invariant for a validation boundary.
Was this helpful? React with 👍 or 👎 to provide feedback.
2 participants
Uh oh!
There was an error while loading. Please reload this page.