Merge lp:~smcv/libgfshare/deb556939 into lp:~dsilvers/libgfshare/devel

[Simon McVittie]

[Simon McVittie (smcv)]

See LP#497996.

=== modified file 'README'
--- README	2006-01-15 17:58:21 +0000
+++ README	2009-12-17 22:43:20 +0000
@@ -28,4 +28,29 @@
 
  -- Daniel Silverstone. 2006-01-15
 
-
+Recovering from previous versions of gfsplit producing foo.000
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The quick version: if you have split a secret into shares and one
+of them is numbered 000, recover the secret by re-labelling it to
+001 (i.e. rename the file, if you're using gfcombine).
+
+Previous versions of libgfshare could incorrectly produce a share
+numbered 000, and the gfsplit utility would produce such a share
+sometimes (with the default settings, a 3-of-5 share, this will
+happen about 2% of the time). In gfsplit this produces filenames
+ending with ".000".
+
+Mathematically, the "share" numbered 0 would be the secret itself,
+which is why it shouldn't be used. However, due to the way libgfshare
+implements multiplication via exp/log tables, the output will
+actually be a copy of the data that would appear in share number 001,
+so the secret is not actually leaked.
+
+Recombining shares that include share number 000 doesn't work: it's
+silently ignored. If share 000 is renamed to share 001, recombination
+should work; the exception is if you already had a copy of share 001,
+in which case you can only recover the secret by having one extra share
+above the normal threshold.
+
+ -- Simon McVittie. 2009-11-18

=== modified file 'src/libgfshare.c'
--- src/libgfshare.c	2006-02-26 14:01:53 +0000
+++ src/libgfshare.c	2009-12-17 22:43:20 +0000
@@ -27,6 +27,7 @@
 #include "libgfshare.h"
 #include "libgfshare_tables.h"
 
+#include <errno.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -65,7 +66,20 @@
                       unsigned char threshold,
                       unsigned int size )
 {
-  gfshare_ctx *ctx = XMALLOC( sizeof(struct _gfshare_ctx) );
+  gfshare_ctx *ctx;
+  unsigned int i;
+
+  for (i = 0; i < sharecount; i++) {
+    if (sharenrs[i] == 0) {
+      /* can't have x[i] = 0 - that would just be a copy of the secret, in
+       * theory (in fact, due to the way we use exp/log for multiplication and
+       * treat log(0) as 0, it ends up as a copy of x[i] = 1) */
+      errno = EINVAL;
+      return NULL;
+    }
+  }
+
+  ctx = XMALLOC( sizeof(struct _gfshare_ctx) );
   ctx->sharecount = sharecount;
   ctx->threshold = threshold;
   ctx->size = size;

=== modified file 'tools/gfcombine.c'
--- tools/gfcombine.c	2006-02-26 14:01:53 +0000
+++ tools/gfcombine.c	2009-12-17 22:43:20 +0000
@@ -52,6 +52,12 @@
   fprintf( stderr, "%s: %s: bad filename\nInput files should be called <name>.NNN\n", progname, fname );
 }
 
+static void
+zero_filename( char* fname )
+{
+  fprintf( stderr, "%s: %s: input files <name>.000 don't work, see README\n", progname, fname );
+}
+
 static int
 check_filenames( char **filenames, int count )
 {
@@ -73,6 +79,12 @@
       bad_filename(filenames[i]);
       return 1;
     }
+    if( filenames[i][nlen-3] == '0' &&
+        filenames[i][nlen-2] == '0' &&
+        filenames[i][nlen-1] == '0') {
+      zero_filename(filenames[i]);
+      return 1;
+    }
   }
   return 0;
 }

=== modified file 'tools/gfsplit.c'
--- tools/gfsplit.c	2006-07-29 12:32:31 +0000
+++ tools/gfsplit.c	2009-12-17 22:43:20 +0000
@@ -92,6 +92,9 @@
   }
   for( i = 0; i < sharecount; ++i ) {
     unsigned char proposed = (random() & 0xff00) >> 8;
+    if( proposed == 0 ) {
+      proposed = 1;
+    }
     SHARENR_TRY_AGAIN:
     for( j = 0; j < i; ++j ) {
       if( sharenrs[j] == proposed ) {