Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SigningKey#sign(message) makes undocumented assumptions about message encoding #221

Open
wmlele opened this issue May 20, 2022 · 1 comment

Comments

@wmlele
Copy link

wmlele commented May 20, 2022

SigningKey#sign(message) is using String#[] to truncate the output from sign_attached(message) which yields unpredictable results according to the message encoding.

[43] pry(main)> data.encoding
=> #<Encoding:UTF-8>
[44] pry(main)> signing_key.sign(data).length
=> 64
[45] pry(main)> signing_key.sign(data).bytesize
=> 77
[53] pry(main)> signing_key.sign(data.force_encoding('ASCII-8BIT')).bytesize
=> 64
@tarcieri
Copy link
Contributor

I would suggest opening a PR which forces the encoding of the output of sign_attached to ASCII-8BIT

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants