1 files changed, 16 insertions, 11 deletions

diff --git a/src/gnunet/crypto/gns_edkey.go b/src/gnunet/crypto/gns_edkey.go
index b7e88b3..930c140 100644
--- a/src/gnunet/crypto/gns_edkey.go
+++ b/src/gnunet/crypto/gns_edkey.go
@@ -1,5 +1,5 @@
 // This file is part of gnunet-go, a GNUnet-implementation in Golang.
-// Copyright (C) 2019-2022 Bernd Fix  >Y<
+// Copyright (C) 2019-2023 Bernd Fix  >Y<
 //
 // gnunet-go is free software: you can redistribute it and/or modify it
 // under the terms of the GNU Affero General Public License as published
@@ -53,17 +53,17 @@ func init() {
 }
 
 //----------------------------------------------------------------------
-// Private key
+// Public key
 //----------------------------------------------------------------------
 
-// EDKEYPublicImpl implements the public key scheme.
+// EDKEYPublicImpl implements the EDKEY public key scheme.
 type EDKEYPublicImpl struct {
         ztype enums.GNSType
         pub   *ed25519.PublicKey
 }
 
-// Init instance from binary data. The data represents a big integer
-// (in big-endian notation) for the private scalar d.
+// Init instance from binary data. The data represents a binary
+// representation of a curve point (as defined in RFC 8032).
 func (pk *EDKEYPublicImpl) Init(data []byte) error {
         pk.ztype = ZONE_EDKEY
         pk.pub = ed25519.NewPublicKeyFromBytes(data)
@@ -79,8 +79,8 @@ func (pk *EDKEYPublicImpl) Bytes() []byte {
 // Derive a public key from this key based on a big integer
 // (key blinding). Returns the derived key and the blinding value.
 func (pk *EDKEYPublicImpl) Derive(h *math.Int) (dPk ZoneKeyImpl, hOut *math.Int, err error) {
-        // limit to allowed value range (see LSD0001 spec)
-        hOut = h.SetBit(255, 0)
+        // limit to allowed value range (see LSD0001 spec, 5.1.2.)
+        hOut = h.Mod(ed25519.GetCurve().N)
         derived := pk.pub.Mult(hOut)
         dPk = &EDKEYPublicImpl{
                 pk.ztype,
@@ -178,8 +178,8 @@ type EDKEYPrivateImpl struct {
         prv  *ed25519.PrivateKey // private key
 }
 
-// Init instance from binary data. The data represents a big integer
-// (in big-endian notation) for the private scalar d.
+// Init instance from binary data. The data represents the seed
+// used to generate the private scalar and nonce (see RFC 8032).
 func (pk *EDKEYPrivateImpl) Init(data []byte) error {
         pk.seed = util.Clone(data)
         pk.prv = ed25519.NewPrivateKeyFromSeed(data)
@@ -208,9 +208,14 @@ func (pk *EDKEYPrivateImpl) Public() ZoneKeyImpl {
 // (key blinding). Returns the derived key and the blinding value.
 func (pk *EDKEYPrivateImpl) Derive(h *math.Int) (dPk ZonePrivateImpl, hOut *math.Int, err error) {
         // limit to allowed value range (see LSD0001 spec 5.1.2)
-        hOut = h.SetBit(255, 0)
+        hOut = h.Mod(ed25519.GetCurve().N)
+
         // derive private key
-        derived := pk.prv.Mult(hOut)
+        a1 := pk.prv.D.Rsh(3)
+        a2 := h.Mul(a1).Mod(ed25519.GetCurve().N)
+        dd := a2.Lsh(3)
+        derived := ed25519.NewPrivateKeyFromD(dd)
+
         // derive nonce
         md := sha256.Sum256(append(pk.prv.Nonce, h.Bytes()...))
         derived.Nonce = md[:]