Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add security remark Javadoc to GroupElement etc. #86

Open
rheitjoh opened this issue Apr 7, 2021 · 0 comments
Open

Add security remark Javadoc to GroupElement etc. #86

rheitjoh opened this issue Apr 7, 2021 · 0 comments
Labels
Gitlab Old issue moved over from Gitlab repository

Comments

@rheitjoh
Copy link
Member

rheitjoh commented Apr 7, 2021

(This issue has been imported from the Gitlab repository because it seems to not have been addressed yet)

Original Text (Issue 186)

Add Javadoc to GroupElement etc. It should state that

  • for op, we assume that right hand side to be in the right group, otherwise behavior is undefined (and may be a security risk)
  • document reasons why getElement(Represenatation) should be used for untrusted Representations of GroupElements, and make clear that you would never trust Group representations from an untrusted source. (Basically, tell people not to send groups alongside their elements just so everything is neatly StandaloneRepresentable).
  • Add some remarks about 3rd party serialization frameworks that use reflection magic to serialize group elements. Not a good idea. It would not be a breach of contract if each group element stored the exponents from which it was formed (i.e. you'd end up with some dlogs in your serialization). More realistically, we do have to normalize elements before sending them. getRepresentation() makes sure that it's safe to send.
@rheitjoh rheitjoh added the Gitlab Old issue moved over from Gitlab repository label Apr 7, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Gitlab Old issue moved over from Gitlab repository
Projects
None yet
Development

No branches or pull requests

1 participant