X-Git-Url: https://git.ozlabs.org/?p=ccan;a=blobdiff_plain;f=ccan%2Fcrypto%2Fshachain%2Fshachain.c;h=a14d95b8cd4d4c665dca18ab88313f90677e314d;hp=4b6a31db3f93f419282ead63467495999263fd54;hb=9fc07111603c6e892ed768f900465282314b2982;hpb=fc6655ed3c4840a5d4d669ad3c44e2ffe1019173

diff --git a/ccan/crypto/shachain/shachain.c b/ccan/crypto/shachain/shachain.c
index 4b6a31db..a14d95b8 100644
--- a/ccan/crypto/shachain/shachain.c
+++ b/ccan/crypto/shachain/shachain.c
@@ -10,12 +10,28 @@ static void change_bit(unsigned char *arr, size_t index)
 	arr[index / CHAR_BIT] ^= (1 << (index % CHAR_BIT));
 }
 
-static void derive(shachain_index_t index, size_t bits, struct sha256 *hash)
+/* We can only ever *unset* bits, so to must only have bits in from. */
+static bool can_derive(shachain_index_t from, shachain_index_t to)
+{
+	return (~from & to) == 0;
+}
+
+static void derive(shachain_index_t from, shachain_index_t to,
+		   const struct sha256 *from_hash,
+		   struct sha256 *hash)
 {
+	shachain_index_t branches;
 	int i;
 
-	for (i = bits - 1; i >= 0; i--) {
-		if (!((index >> i) & 1)) {
+	assert(can_derive(from, to));
+
+	/* We start with the first hash. */
+	*hash = *from_hash;
+
+	/* This represents the bits set in from, and not to. */
+	branches = from ^ to;
+	for (i = ilog64(branches) - 1; i >= 0; i--) {
+		if (((branches >> i) & 1)) {
 			change_bit(hash->u.u8, i);
 			sha256(hash, hash, 1);
 		}
@@ -25,8 +41,7 @@ static void derive(shachain_index_t index, size_t bits, struct sha256 *hash)
 void shachain_from_seed(const struct sha256 *seed, shachain_index_t index,
 			struct sha256 *hash)
 {
-	*hash = *seed;
-	derive(index, sizeof(index) * CHAR_BIT, hash);
+	derive((shachain_index_t)-1ULL, index, seed, hash);
 }
 
 void shachain_init(struct shachain *shachain)
@@ -34,13 +49,7 @@ void shachain_init(struct shachain *shachain)
 	shachain->num_valid = 0;
 }
 
-/* We can only ever *unset* bits, so to must only have bits in from. */
-static bool can_derive(shachain_index_t from, shachain_index_t to)
-{
-	return (~from & to) == 0;
-}
-
-void shachain_add_hash(struct shachain *chain,
+bool shachain_add_hash(struct shachain *chain,
 		       shachain_index_t index, const struct sha256 *hash)
 {
 	int i;
@@ -48,8 +57,16 @@ void shachain_add_hash(struct shachain *chain,
 	for (i = 0; i < chain->num_valid; i++) {
 		/* If we could derive this value, we don't need it,
 		 * not any others (since they're in order). */
-		if (can_derive(index, chain->known[i].index))
+		if (can_derive(index, chain->known[i].index)) {
+			struct sha256 expect;
+
+			/* Make sure the others derive as expected! */
+			derive(index, chain->known[i].index, hash, &expect);
+			if (memcmp(&expect, &chain->known[i].hash,
+				   sizeof(expect)) != 0)
+				return false;
 			break;
+		}
 	}
 
 	/* This can happen if you skip indices! */
@@ -57,6 +74,7 @@ void shachain_add_hash(struct shachain *chain,
 	chain->known[i].index = index;
 	chain->known[i].hash = *hash;
 	chain->num_valid = i+1;
+	return true;
 }
 
 bool shachain_get_hash(const struct shachain *chain,
@@ -65,22 +83,13 @@ bool shachain_get_hash(const struct shachain *chain,
 	int i;
 
 	for (i = 0; i < chain->num_valid; i++) {
-		shachain_index_t diff;
-
 		/* If we can get from key to index only by resetting bits,
 		 * we can derive from it => index has no bits key doesn't. */
 		if (!can_derive(chain->known[i].index, index))
 			continue;
 
-		/* Start from this hash. */
-		*hash = chain->known[i].hash;
-
-		/* This indicates the bits which are in 'index' and
-		 * not the key */
-		diff = index ^ chain->known[i].index;
-
-		/* Using ilog64 here is an optimization. */
-		derive(~diff, ilog64(diff), hash);
+		derive(chain->known[i].index, index, &chain->known[i].hash,
+		       hash);
 		return true;
 	}
 	return false;