Reject identity point or small order public keys

go.mod

@@ -1,7 +1,10 @@
 module github.com/nats-io/nkeys
 
-go 1.25.0
+go 1.26.0
 
-require golang.org/x/crypto v0.52.0
+require (
+	filippo.io/edwards25519 v1.1.0
+	golang.org/x/crypto v0.52.0
+)
 
 require golang.org/x/sys v0.45.0 // indirect

go.sum

@@ -1,3 +1,5 @@
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
 golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=

strkey.go

@@ -18,6 +18,8 @@ import (
 	"crypto/ed25519"
 	"encoding/base32"
 	"encoding/binary"
+
+	"filippo.io/edwards25519"
 )
 
 // PrefixByte is a lead byte representing the type.
@@ -216,6 +218,8 @@ func IsValidPublicKey(src string) bool {
 	return err == nil
 }
 
+var identityPoint = edwards25519.NewIdentityPoint()
+
 func decodePublicKey(public string) (PrefixByte, []byte, error) {
 	raw, err := decode([]byte(public))
 	if err != nil {
@@ -228,37 +232,46 @@ func decodePublicKey(public string) (PrefixByte, []byte, error) {
 	if len(raw[1:]) != ed25519.PublicKeySize {
 		return PrefixByteUnknown, nil, ErrInvalidPublicKey
 	}
+	if pre != PrefixByteCurve {
+		var pt edwards25519.Point
+		if _, err := pt.SetBytes(raw[1:]); err != nil || !bytes.Equal(pt.Bytes(), raw[1:]) {
+			return PrefixByteUnknown, nil, ErrInvalidPublicKey
+		}
+		if pt.MultByCofactor(&pt).Equal(identityPoint) == 1 {
+			return PrefixByteUnknown, nil, ErrInvalidPublicKey
+		}
+	}
 	return pre, raw[1:], nil
 }
 
 // IsValidPublicUserKey will decode and verify the string is a valid encoded Public User Key.
 func IsValidPublicUserKey(src string) bool {
-	_, err := Decode(PrefixByteUser, []byte(src))
-	return err == nil
+	return isValidPublicKey(src, PrefixByteUser)
 }
 
 // IsValidPublicAccountKey will decode and verify the string is a valid encoded Public Account Key.
 func IsValidPublicAccountKey(src string) bool {
-	_, err := Decode(PrefixByteAccount, []byte(src))
-	return err == nil
+	return isValidPublicKey(src, PrefixByteAccount)
 }
 
 // IsValidPublicServerKey will decode and verify the string is a valid encoded Public Server Key.
 func IsValidPublicServerKey(src string) bool {
-	_, err := Decode(PrefixByteServer, []byte(src))
-	return err == nil
+	return isValidPublicKey(src, PrefixByteServer)
 }
 
 // IsValidPublicClusterKey will decode and verify the string is a valid encoded Public Cluster Key.
 func IsValidPublicClusterKey(src string) bool {
-	_, err := Decode(PrefixByteCluster, []byte(src))
-	return err == nil
+	return isValidPublicKey(src, PrefixByteCluster)
 }
 
 // IsValidPublicOperatorKey will decode and verify the string is a valid encoded Public Operator Key.
 func IsValidPublicOperatorKey(src string) bool {
-	_, err := Decode(PrefixByteOperator, []byte(src))
-	return err == nil
+	return isValidPublicKey(src, PrefixByteOperator)
+}
+
+func isValidPublicKey(src string, expected PrefixByte) bool {
+	prefix, _, err := decodePublicKey(src)
+	return err == nil && prefix == expected
 }
 
 // IsValidPublicCurveKey will decode and verify the string is a valid encoded Public Curve Key.

strkey_test.go

@@ -16,9 +16,56 @@ package nkeys
 import (
 	"bytes"
 	"encoding/binary"
+	"encoding/hex"
 	"testing"
+
+	"filippo.io/edwards25519"
 )
 
+func TestRejectSmallOrderPublicKeys(t *testing.T) {
+	lowOrderGeneratorBytes, err := hex.DecodeString("26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85")
+	if err != nil {
+		t.Fatal(err)
+	}
+	lowOrderGenerator, err := new(edwards25519.Point).SetBytes(lowOrderGeneratorBytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	validators := []struct {
+		prefix PrefixByte
+		valid  func(string) bool
+	}{
+		{PrefixByteOperator, IsValidPublicOperatorKey},
+		{PrefixByteServer, IsValidPublicServerKey},
+		{PrefixByteCluster, IsValidPublicClusterKey},
+		{PrefixByteAccount, IsValidPublicAccountKey},
+		{PrefixByteUser, IsValidPublicUserKey},
+	}
+
+	point := edwards25519.NewIdentityPoint()
+	for order := range 8 {
+		for _, validator := range validators {
+			encoded, err := Encode(validator.prefix, point.Bytes())
+			if err != nil {
+				t.Fatal(err)
+			}
+			public := string(encoded)
+
+			if IsValidPublicKey(public) {
+				t.Fatalf("small order point %d with prefix %s passed general validation", order, validator.prefix)
+			}
+			if validator.valid(public) {
+				t.Fatalf("small order point %d with prefix %s passed typed validation", order, validator.prefix)
+			}
+			if _, err := FromPublicKey(public); err != ErrInvalidPublicKey {
+				t.Fatalf("small order point %d with prefix %s: expected %v, got %v", order, validator.prefix, ErrInvalidPublicKey, err)
+			}
+		}
+		point.Add(point, lowOrderGenerator)
+	}
+}
+
 func BenchmarkDecode(b *testing.B) {
 	tcs := []struct {
 		name string