diff --git a/src/rust/src/backend/ec.rs b/src/rust/src/backend/ec.rs index 5a8efe7da..793ae48cf 100644 --- a/src/rust/src/backend/ec.rs +++ b/src/rust/src/backend/ec.rs @@ -186,7 +186,9 @@ fn derive_private_key( point.mul_generator(&curve, &private_value, &bn_ctx)?; let ec = openssl::ec::EcKey::from_private_components(&curve, &private_value, &point) .map_err(|_| pyo3::exceptions::PyValueError::new_err("Invalid EC key"))?; - check_key_infinity(&ec)?; + ec.check_key().map_err(|_| { + pyo3::exceptions::PyValueError::new_err("Invalid EC key (key out of range, infinity, etc.)") + })?; let pkey = openssl::pkey::PKey::from_ec_key(ec)?; Ok(ECPrivateKey { diff --git a/tests/hazmat/primitives/test_ec.py b/tests/hazmat/primitives/test_ec.py index d33fd104c..2a30c6661 100644 --- a/tests/hazmat/primitives/test_ec.py +++ b/tests/hazmat/primitives/test_ec.py @@ -144,6 +144,16 @@ def test_derive_point_at_infinity(backend): ec.derive_private_key(q, ec.SECP256R1()) +def test_derive_point_invalid_key(backend): + curve = ec.SECP256R1() + _skip_curve_unsupported(backend, curve) + with pytest.raises(ValueError): + ec.derive_private_key( + 0xE2563328DFABF68188606B91324281C1D58A4456431B09D510B35FECC9F307CA1822846FA2671371A9A81BAC0E35749D, + curve, + ) + + def test_ec_numbers(): numbers = ec.EllipticCurvePrivateNumbers( 1, ec.EllipticCurvePublicNumbers(2, 3, DummyCurve())