Add regression test for CVE-2026-21895 (per @tarcieri's note in #690)#692
Merged
tarcieri merged 1 commit intoRustCrypto:masterfrom May 1, 2026
Merged
Conversation
Per @tarcieri's note in RustCrypto#690: the panic-on-prime-equal-1 fix landed on master via the num-bigint -> crypto-bigint refactor, but the regression test from upstream commit 2926c91 (PR RustCrypto#624) was not carried over. This adds an adapted port of that test: - Original used num-bigint BigUint; this version uses crypto-bigint BoxedUint to match current master. - Original used a small public exponent (185) which the current from_components rejects via the standard exponent-size check; this version goes through from_components_with_large_exponent so the exact same numeric inputs from the original test can be used. The test is therefore gated on the hazmat feature, consistent with the other small/large-exponent tests in this module. - Asserts Err(Error::InvalidPrime) rather than a panic, matching the upstream fix's intent. No production-code changes; the underlying logic fix (prime <= one => InvalidPrime in validate_private_key_parts) is already present on master. Refs: GHSA-9c48-w39g-hm26, RustCrypto#690, RustCrypto#624
tarcieri
approved these changes
May 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Per @tarcieri's reply on #690:
The production fix lives on master already (
validate_private_key_partsrejects anyprime <= onewithError::InvalidPrime, src/key.rs:760-763). What was missing was the regression test added alongside it in upstream commit2926c91bef(PR #624). This PR ports just that test.Adaptations vs the original test
num-bigint::BigUintconstructors (BigUint::from_u64,BigUint::zero()); ported tocrypto-bigint::BoxedUint::from(u64)since that's what current master'sfrom_componentsAPI takes.n=239, e=185, d=0, primes=[1, 239]) include anebelow master'sMIN_PUB_EXPONENTbound, so the test callsfrom_components_with_large_exponent(gated#[cfg(feature = "hazmat")], matching the existingtest_from_components_with_small_exponent/test_from_components_with_large_exponentneighbors) rather thanfrom_components. Ordering insidevalidate_skip_exponent_size->validate_private_key_partsstill hits theprime <= onecheck first, so we exercise exactly the path the original test did.Err(Error::InvalidPrime)(not a panic) — same intent as the original.No production-code changes. Single-file diff in
src/key.rs.Refs: GHSA-9c48-w39g-hm26, #690, #624, upstream
2926c91bef.