Commit 9933b9e5e1a3f5b1019c75f93bd265d4a1ecc270 introduced cofactor support into
gcrypt.
However, the commit had a bug: in cipher/ecc.c, around line 900, the call to
sexp_extract_param() duplicates the E.n parameter, which leads to E.h being
unset. The second &pk.E.n should be &pk.E.h.
This is the diff that contains the bug:
@@ -905,9 +912,9 @@ ecc_verify (gcry_sexp_t s_sig, gcry_sexp_t s_data,
gcry_sexp_t s_keyparms)
- Extract the key. */ if ((ctx.flags & PUBKEY_FLAG_PARAM))
- rc = sexp_extract_param (s_keyparms, NULL, "-p?a?b?g?n?/q",
+ rc = sexp_extract_param (s_keyparms, NULL, "-p?a?b?g?n?h?/q",
&pk.E.p, &pk.E.a, &pk.E.b, &mpi_g, &pk.E.n,
- &mpi_q, NULL);
+ &pk.E.n, &mpi_q, NULL);
else
rc = sexp_extract_param (s_keyparms, NULL, "/q",
&mpi_q, NULL);