From da42c385fc39f924b94333991298ac4e079c0b2d Mon Sep 17 00:00:00 2001
From: dignifiedquire <dignifiedquire@users.noreply.github.com>
Date: Fri, 28 Jun 2019 12:05:46 +0200
Subject: [PATCH 1/8] fix: do not allocate when comparing keys

---
 crypto/key.go      |  8 +++++---
 crypto/key_test.go | 30 +++++++++++++++++++++--------
 crypto/rsa_go.go   | 47 ++++++++++++++++++++++++++++++++++++++++++++--
 3 files changed, 72 insertions(+), 13 deletions(-)

diff --git a/crypto/key.go b/crypto/key.go
index bc0026e..663334f 100644
--- a/crypto/key.go
+++ b/crypto/key.go
@@ -363,7 +363,9 @@ func KeyEqual(k1, k2 Key) bool {
 		return true
 	}
 
-	b1, err1 := k1.Bytes()
-	b2, err2 := k2.Bytes()
-	return subtle.ConstantTimeCompare(b1, b2) == 1 && err1 == err2
+	if k1.Type() != k2.Type() {
+		return false
+	}
+
+	return k1.Equals(k2)
 }
diff --git a/crypto/key_test.go b/crypto/key_test.go
index 0b25432..dcb962f 100644
--- a/crypto/key_test.go
+++ b/crypto/key_test.go
@@ -101,18 +101,19 @@ func testKeyEncoding(t *testing.T, sk PrivKey) {
 }
 
 func testKeyEquals(t *testing.T, k Key) {
-	kb, err := k.Bytes()
-	if err != nil {
-		t.Fatal(err)
-	}
+	// kb, err := k.Raw()
+	// if err != nil {
+	// 	t.Fatal(err)
+	// }
 
 	if !KeyEqual(k, k) {
 		t.Fatal("Key not equal to itself.")
 	}
 
-	if !KeyEqual(k, testkey(kb)) {
-		t.Fatal("Key not equal to key with same bytes.")
-	}
+	// bad test, relies on deep internals..
+	// if !KeyEqual(k, testkey(kb)) {
+	// 	t.Fatal("Key not equal to key with same bytes.")
+	// }
 
 	sk, pk, err := test.RandTestKeyPair(RSA, 512)
 	if err != nil {
@@ -143,7 +144,20 @@ func (pk testkey) Raw() ([]byte, error) {
 }
 
 func (pk testkey) Equals(k Key) bool {
-	return KeyEqual(pk, k)
+	if pk.Type() != k.Type() {
+		return false
+	}
+	a, err := pk.Raw()
+	if err != nil {
+		return false
+	}
+
+	b, err := k.Raw()
+	if err != nil {
+		return false
+	}
+
+	return bytes.Equal(a, b)
 }
 
 func TestUnknownCurveErrors(t *testing.T) {
diff --git a/crypto/rsa_go.go b/crypto/rsa_go.go
index 023588e..64534d5 100644
--- a/crypto/rsa_go.go
+++ b/crypto/rsa_go.go
@@ -3,6 +3,7 @@
 package crypto
 
 import (
+	"bytes"
 	"crypto"
 	"crypto/rand"
 	"crypto/rsa"
@@ -63,7 +64,21 @@ func (pk *RsaPublicKey) Raw() ([]byte, error) {
 
 // Equals checks whether this key is equal to another
 func (pk *RsaPublicKey) Equals(k Key) bool {
-	return KeyEqual(pk, k)
+	// make sure this is an rsa public key
+	other, ok := (k).(*RsaPublicKey)
+	if !ok {
+		a, err := pk.Raw()
+		if err != nil {
+			return false
+		}
+		b, err := k.Raw()
+		if err != nil {
+			return false
+		}
+		return bytes.Equal(a, b)
+	}
+
+	return pk.k.N.Cmp(other.k.N) == 0 && pk.k.E == other.k.E
 }
 
 // Sign returns a signature of the input data
@@ -93,7 +108,35 @@ func (sk *RsaPrivateKey) Raw() ([]byte, error) {
 
 // Equals checks whether this key is equal to another
 func (sk *RsaPrivateKey) Equals(k Key) bool {
-	return KeyEqual(sk, k)
+	// make sure this is an rsa public key
+	other, ok := (k).(*RsaPrivateKey)
+	if !ok {
+		a, err := sk.Raw()
+		if err != nil {
+			return false
+		}
+		b, err := k.Raw()
+		if err != nil {
+			return false
+		}
+		return bytes.Equal(a, b)
+	}
+
+	a := sk.sk
+	b := other.sk
+
+	if a.PublicKey.N.Cmp(b.PublicKey.N) != 0 {
+		return false
+	}
+	if a.PublicKey.E != b.PublicKey.E {
+		return false
+	}
+
+	if a.D.Cmp(b.D) != 0 {
+		return false
+	}
+
+	return true
 }
 
 // UnmarshalRsaPrivateKey returns a private key from the input x509 bytes

From bab5f6dd95796a9ab2c640d24c9e0219237a6c96 Mon Sep 17 00:00:00 2001
From: dignifiedquire <dignifiedquire@users.noreply.github.com>
Date: Fri, 28 Jun 2019 12:35:29 +0200
Subject: [PATCH 2/8] fixup: openssl

---
 crypto/openssl_common.go | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/crypto/openssl_common.go b/crypto/openssl_common.go
index f235e75..06c458a 100644
--- a/crypto/openssl_common.go
+++ b/crypto/openssl_common.go
@@ -3,6 +3,8 @@
 package crypto
 
 import (
+	"bytes"
+
 	pb "github.com/libp2p/go-libp2p-core/crypto/pb"
 
 	openssl "github.com/spacemonkeygo/openssl"
@@ -61,7 +63,15 @@ func (pk *opensslPublicKey) Raw() ([]byte, error) {
 
 // Equals checks whether this key is equal to another
 func (pk *opensslPublicKey) Equals(k Key) bool {
-	return KeyEqual(pk, k)
+	a, err := pk.Raw()
+	if err != nil {
+		return false
+	}
+	b, err := k.Raw()
+	if err != nil {
+		return false
+	}
+	return bytes.Equal(a, b)
 }
 
 // Sign returns a signature of the input data
@@ -94,5 +104,13 @@ func (sk *opensslPrivateKey) Raw() ([]byte, error) {
 
 // Equals checks whether this key is equal to another
 func (sk *opensslPrivateKey) Equals(k Key) bool {
-	return KeyEqual(sk, k)
+	a, err := sk.Raw()
+	if err != nil {
+		return false
+	}
+	b, err := k.Raw()
+	if err != nil {
+		return false
+	}
+	return bytes.Equal(a, b)
 }

From 2df9672ee4ca90abfbf0a70033e7fe403358af6b Mon Sep 17 00:00:00 2001
From: dignifiedquire <dignifiedquire@users.noreply.github.com>
Date: Fri, 28 Jun 2019 14:04:56 +0200
Subject: [PATCH 3/8] use equal method from openssl

uses https://github.com/spacemonkeygo/openssl/pull/126
---
 crypto/openssl_common.go | 46 +++++++++++++++++++++++++---------------
 crypto/rsa_openssl.go    |  2 +-
 go.mod                   |  2 +-
 go.sum                   | 12 +++++------
 4 files changed, 37 insertions(+), 25 deletions(-)

diff --git a/crypto/openssl_common.go b/crypto/openssl_common.go
index 06c458a..164ade8 100644
--- a/crypto/openssl_common.go
+++ b/crypto/openssl_common.go
@@ -7,7 +7,7 @@ import (
 
 	pb "github.com/libp2p/go-libp2p-core/crypto/pb"
 
-	openssl "github.com/spacemonkeygo/openssl"
+	openssl "github.com/libp2p/go-openssl"
 )
 
 // define these as separate types so we can add more key types later and reuse
@@ -63,15 +63,21 @@ func (pk *opensslPublicKey) Raw() ([]byte, error) {
 
 // Equals checks whether this key is equal to another
 func (pk *opensslPublicKey) Equals(k Key) bool {
-	a, err := pk.Raw()
-	if err != nil {
-		return false
+	k0, ok := k.(*RsaPublicKey)
+	if !ok {
+		a, err := pk.Raw()
+		if err != nil {
+			return false
+		}
+		b, err := k.Raw()
+		if err != nil {
+			return false
+		}
+
+		return bytes.Equal(a, b)
 	}
-	b, err := k.Raw()
-	if err != nil {
-		return false
-	}
-	return bytes.Equal(a, b)
+
+	return pk.key.Equal(k0.opensslPublicKey.key)
 }
 
 // Sign returns a signature of the input data
@@ -104,13 +110,19 @@ func (sk *opensslPrivateKey) Raw() ([]byte, error) {
 
 // Equals checks whether this key is equal to another
 func (sk *opensslPrivateKey) Equals(k Key) bool {
-	a, err := sk.Raw()
-	if err != nil {
-		return false
+	k0, ok := k.(*RsaPrivateKey)
+	if !ok {
+		a, err := sk.Raw()
+		if err != nil {
+			return false
+		}
+		b, err := k.Raw()
+		if err != nil {
+			return false
+		}
+
+		return bytes.Equal(a, b)
 	}
-	b, err := k.Raw()
-	if err != nil {
-		return false
-	}
-	return bytes.Equal(a, b)
+
+	return sk.key.Equal(k0.opensslPrivateKey.key)
 }
diff --git a/crypto/rsa_openssl.go b/crypto/rsa_openssl.go
index 913dead..fd9d451 100644
--- a/crypto/rsa_openssl.go
+++ b/crypto/rsa_openssl.go
@@ -6,7 +6,7 @@ import (
 	"errors"
 	"io"
 
-	openssl "github.com/spacemonkeygo/openssl"
+	openssl "github.com/libp2p/go-openssl"
 )
 
 // RsaPrivateKey is an rsa private key
diff --git a/go.mod b/go.mod
index e875b67..ff1b4ca 100644
--- a/go.mod
+++ b/go.mod
@@ -8,12 +8,12 @@ require (
 	github.com/jbenet/goprocess v0.1.3
 	github.com/libp2p/go-flow-metrics v0.0.1
 	github.com/libp2p/go-msgio v0.0.4
+	github.com/libp2p/go-openssl v0.0.1
 	github.com/minio/sha256-simd v0.1.0
 	github.com/mr-tron/base58 v1.1.2
 	github.com/multiformats/go-multiaddr v0.0.4
 	github.com/multiformats/go-multihash v0.0.5
 	github.com/smola/gocompat v0.2.0
-	github.com/spacemonkeygo/openssl v0.0.0-20181017203307-c2dcc5cca94a
 	go.opencensus.io v0.21.0
 	golang.org/x/crypto v0.0.0-20190618222545-ea8f1a30c443
 )
diff --git a/go.sum b/go.sum
index 1a08908..e63e210 100644
--- a/go.sum
+++ b/go.sum
@@ -68,13 +68,14 @@ github.com/libp2p/go-flow-metrics v0.0.1 h1:0gxuFd2GuK7IIP5pKljLwps6TvcuYgvG7Atq
 github.com/libp2p/go-flow-metrics v0.0.1/go.mod h1:Iv1GH0sG8DtYN3SVJ2eG221wMiNpZxBdp967ls1g+k8=
 github.com/libp2p/go-msgio v0.0.4 h1:agEFehY3zWJFUHK6SEMR7UYmk2z6kC3oeCM7ybLhguA=
 github.com/libp2p/go-msgio v0.0.4/go.mod h1:63lBBgOTDKQL6EWazRMCwXsEeEeK9O2Cd+0+6OOuipQ=
+github.com/libp2p/go-msgio v0.0.4 h1:agEFehY3zWJFUHK6SEMR7UYmk2z6kC3oeCM7ybLhguA=
+github.com/libp2p/go-msgio v0.0.4/go.mod h1:63lBBgOTDKQL6EWazRMCwXsEeEeK9O2Cd+0+6OOuipQ=
+github.com/libp2p/go-openssl v0.0.1 h1:hOIo7l0lXir9UzQE2zPxwd/Gdts1LFik0nqhbDZrG8U=
+github.com/libp2p/go-openssl v0.0.1/go.mod h1:v8Zw2ijCSWBQi8Pq5GAixw6DbFfa9u6VIYDXnvOXkc0=
 github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329 h1:2gxZ0XQIU/5z3Z3bUBu+FXuk2pFbkN6tcwi/pjyaDic=
 github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-isatty v0.0.4 h1:bnP0vzxcAdeI1zdubAl5PjU6zsERjGZb7raWodagDYs=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b h1:j7+1HpAFS1zy5+Q4qx1fWh90gTKwiN4QCGoY9TWyyO4=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/minio/blake2b-simd v0.0.0-20160723061019-3f5f724cb5b1 h1:lYpkrQH5ajf0OXOcUbGjvZxxijuBwbbmlSxLiuofa+g=
 github.com/minio/blake2b-simd v0.0.0-20160723061019-3f5f724cb5b1/go.mod h1:pD8RvIylQ358TN4wwqatJ8rNavkEINozVn9DtGI3dfQ=
@@ -102,12 +103,9 @@ github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/sirupsen/logrus v1.2.0 h1:juTguoYk5qI21pwyTXY3B3Y5cOTH3ZUyZCg1v/mihuo=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/smola/gocompat v0.2.0 h1:6b1oIMlUXIpz//VKEDzPVBK8KG7beVwmHIUEBIs/Pns=
 github.com/smola/gocompat v0.2.0/go.mod h1:1B0MlxbmoZNo3h8guHp8HztB3BSYR5itql9qtVc0ypY=
-github.com/spacemonkeygo/openssl v0.0.0-20181017203307-c2dcc5cca94a h1:/eS3yfGjQKG+9kayBkj0ip1BGhq6zJ3eaVksphxAaek=
-github.com/spacemonkeygo/openssl v0.0.0-20181017203307-c2dcc5cca94a/go.mod h1:7AyxJNCJ7SBZ1MfVQCWD6Uqo2oubI2Eq2y2eqf+A5r0=
 github.com/spacemonkeygo/spacelog v0.0.0-20180420211403-2296661a0572 h1:RC6RW7j+1+HkWaX/Yh71Ee5ZHaHYt7ZP4sQgUrm6cDU=
 github.com/spacemonkeygo/spacelog v0.0.0-20180420211403-2296661a0572/go.mod h1:w0SWMsp6j9O/dk4/ZpIhL+3CkG8ofA2vuv7k+ltqUMc=
 github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
@@ -154,6 +152,8 @@ golang.org/x/sys v0.0.0-20190219092855-153ac476189d h1:Z0Ahzd7HltpJtjAHHxX8QFP3j
 golang.org/x/sys v0.0.0-20190219092855-153ac476189d/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d h1:+R4KGOnez64A81RvjARKc4UT5/tI9ujCIVX+P5KiHuI=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190626221950-04f50cda93cb h1:fgwFCsaw9buMuxNd6+DQfAuSFqbNiQZpcgJQAgJsK6k=
+golang.org/x/sys v0.0.0-20190626221950-04f50cda93cb/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635 h1:2eB4G6bDQDeP69ZXbOKC00S2Kf6TIiRS+DzfKsKeQU0=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

From 9a4415d1a6d3d7ab16df44d017e26e7a453d6ab6 Mon Sep 17 00:00:00 2001
From: Steven Allen <steven@stebalien.com>
Date: Fri, 28 Jun 2019 17:23:16 +0200
Subject: [PATCH 4/8] use a fallback basicEquals function everywhere

This also ensures we check that the types are equal, even if we're comparing
directly with `k1.Equals(k2)` instead of `KeyEquals(k1, k2)`.
---
 crypto/ecdsa.go          |  4 ++--
 crypto/key.go            | 15 ++++++++++++++-
 crypto/openssl_common.go | 24 ++----------------------
 crypto/rsa_go.go         | 21 ++-------------------
 crypto/secp256k1.go      |  4 ++--
 5 files changed, 22 insertions(+), 46 deletions(-)

diff --git a/crypto/ecdsa.go b/crypto/ecdsa.go
index c069d0c..42ce5d8 100644
--- a/crypto/ecdsa.go
+++ b/crypto/ecdsa.go
@@ -119,7 +119,7 @@ func (ePriv *ECDSAPrivateKey) Raw() ([]byte, error) {
 func (ePriv *ECDSAPrivateKey) Equals(o Key) bool {
 	oPriv, ok := o.(*ECDSAPrivateKey)
 	if !ok {
-		return false
+		return basicEquals(ePriv, o)
 	}
 
 	return ePriv.priv.D.Cmp(oPriv.priv.D) == 0
@@ -163,7 +163,7 @@ func (ePub ECDSAPublicKey) Raw() ([]byte, error) {
 func (ePub *ECDSAPublicKey) Equals(o Key) bool {
 	oPub, ok := o.(*ECDSAPublicKey)
 	if !ok {
-		return false
+		return basicEquals(ePub, o)
 	}
 
 	return ePub.pub.X != nil && ePub.pub.Y != nil && oPub.pub.X != nil && oPub.pub.Y != nil &&
diff --git a/crypto/key.go b/crypto/key.go
index 663334f..ddd2382 100644
--- a/crypto/key.go
+++ b/crypto/key.go
@@ -4,6 +4,7 @@
 package crypto
 
 import (
+	"bytes"
 	"crypto/elliptic"
 	"crypto/hmac"
 	"crypto/rand"
@@ -363,9 +364,21 @@ func KeyEqual(k1, k2 Key) bool {
 		return true
 	}
 
+	return k1.Equals(k2)
+}
+
+func basicEquals(k1, k2 Key) bool {
 	if k1.Type() != k2.Type() {
 		return false
 	}
 
-	return k1.Equals(k2)
+	a, err := k1.Raw()
+	if err != nil {
+		return false
+	}
+	b, err := k2.Raw()
+	if err != nil {
+		return false
+	}
+	return bytes.Equal(a, b)
 }
diff --git a/crypto/openssl_common.go b/crypto/openssl_common.go
index 164ade8..2466521 100644
--- a/crypto/openssl_common.go
+++ b/crypto/openssl_common.go
@@ -3,8 +3,6 @@
 package crypto
 
 import (
-	"bytes"
-
 	pb "github.com/libp2p/go-libp2p-core/crypto/pb"
 
 	openssl "github.com/libp2p/go-openssl"
@@ -65,16 +63,7 @@ func (pk *opensslPublicKey) Raw() ([]byte, error) {
 func (pk *opensslPublicKey) Equals(k Key) bool {
 	k0, ok := k.(*RsaPublicKey)
 	if !ok {
-		a, err := pk.Raw()
-		if err != nil {
-			return false
-		}
-		b, err := k.Raw()
-		if err != nil {
-			return false
-		}
-
-		return bytes.Equal(a, b)
+		return basicEquals(pk, k)
 	}
 
 	return pk.key.Equal(k0.opensslPublicKey.key)
@@ -112,16 +101,7 @@ func (sk *opensslPrivateKey) Raw() ([]byte, error) {
 func (sk *opensslPrivateKey) Equals(k Key) bool {
 	k0, ok := k.(*RsaPrivateKey)
 	if !ok {
-		a, err := sk.Raw()
-		if err != nil {
-			return false
-		}
-		b, err := k.Raw()
-		if err != nil {
-			return false
-		}
-
-		return bytes.Equal(a, b)
+		return basicEquals(sk, k)
 	}
 
 	return sk.key.Equal(k0.opensslPrivateKey.key)
diff --git a/crypto/rsa_go.go b/crypto/rsa_go.go
index 64534d5..4fd2021 100644
--- a/crypto/rsa_go.go
+++ b/crypto/rsa_go.go
@@ -3,7 +3,6 @@
 package crypto
 
 import (
-	"bytes"
 	"crypto"
 	"crypto/rand"
 	"crypto/rsa"
@@ -67,15 +66,7 @@ func (pk *RsaPublicKey) Equals(k Key) bool {
 	// make sure this is an rsa public key
 	other, ok := (k).(*RsaPublicKey)
 	if !ok {
-		a, err := pk.Raw()
-		if err != nil {
-			return false
-		}
-		b, err := k.Raw()
-		if err != nil {
-			return false
-		}
-		return bytes.Equal(a, b)
+		return basicEquals(pk, k)
 	}
 
 	return pk.k.N.Cmp(other.k.N) == 0 && pk.k.E == other.k.E
@@ -111,15 +102,7 @@ func (sk *RsaPrivateKey) Equals(k Key) bool {
 	// make sure this is an rsa public key
 	other, ok := (k).(*RsaPrivateKey)
 	if !ok {
-		a, err := sk.Raw()
-		if err != nil {
-			return false
-		}
-		b, err := k.Raw()
-		if err != nil {
-			return false
-		}
-		return bytes.Equal(a, b)
+		return basicEquals(sk, k)
 	}
 
 	a := sk.sk
diff --git a/crypto/secp256k1.go b/crypto/secp256k1.go
index d2ac74b..e2205df 100644
--- a/crypto/secp256k1.go
+++ b/crypto/secp256k1.go
@@ -66,7 +66,7 @@ func (k *Secp256k1PrivateKey) Raw() ([]byte, error) {
 func (k *Secp256k1PrivateKey) Equals(o Key) bool {
 	sk, ok := o.(*Secp256k1PrivateKey)
 	if !ok {
-		return false
+		return basicEquals(k, o)
 	}
 
 	return k.D.Cmp(sk.D) == 0
@@ -107,7 +107,7 @@ func (k *Secp256k1PublicKey) Raw() ([]byte, error) {
 func (k *Secp256k1PublicKey) Equals(o Key) bool {
 	sk, ok := o.(*Secp256k1PublicKey)
 	if !ok {
-		return false
+		return basicEquals(k, o)
 	}
 
 	return (*btcec.PublicKey)(k).IsEqual((*btcec.PublicKey)(sk))

From 963cc997b271eed2dcfe7f01e51c95191ad5adf0 Mon Sep 17 00:00:00 2001
From: Steven Allen <steven@stebalien.com>
Date: Sat, 29 Jun 2019 12:08:33 +0200
Subject: [PATCH 5/8] remove non-constant-time private key comparison

---
 crypto/key.go       | 3 +--
 crypto/rsa_go.go    | 5 +----
 crypto/secp256k1.go | 2 +-
 3 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/crypto/key.go b/crypto/key.go
index ddd2382..fea3e31 100644
--- a/crypto/key.go
+++ b/crypto/key.go
@@ -4,7 +4,6 @@
 package crypto
 
 import (
-	"bytes"
 	"crypto/elliptic"
 	"crypto/hmac"
 	"crypto/rand"
@@ -380,5 +379,5 @@ func basicEquals(k1, k2 Key) bool {
 	if err != nil {
 		return false
 	}
-	return bytes.Equal(a, b)
+	return subtle.ConstantTimeCompare(a, b) == 1
 }
diff --git a/crypto/rsa_go.go b/crypto/rsa_go.go
index 4fd2021..f8b5999 100644
--- a/crypto/rsa_go.go
+++ b/crypto/rsa_go.go
@@ -108,6 +108,7 @@ func (sk *RsaPrivateKey) Equals(k Key) bool {
 	a := sk.sk
 	b := other.sk
 
+	// Don't care about constant time. We're only comparing the public half.
 	if a.PublicKey.N.Cmp(b.PublicKey.N) != 0 {
 		return false
 	}
@@ -115,10 +116,6 @@ func (sk *RsaPrivateKey) Equals(k Key) bool {
 		return false
 	}
 
-	if a.D.Cmp(b.D) != 0 {
-		return false
-	}
-
 	return true
 }
 
diff --git a/crypto/secp256k1.go b/crypto/secp256k1.go
index e2205df..6e98ea6 100644
--- a/crypto/secp256k1.go
+++ b/crypto/secp256k1.go
@@ -69,7 +69,7 @@ func (k *Secp256k1PrivateKey) Equals(o Key) bool {
 		return basicEquals(k, o)
 	}
 
-	return k.D.Cmp(sk.D) == 0
+	return k.GetPublic().Equals(sk.GetPublic())
 }
 
 // Sign returns a signature from input data

From 543dbe6c2964df7c9006994de63afc6f77462d2c Mon Sep 17 00:00:00 2001
From: Steven Allen <steven@stebalien.com>
Date: Thu, 1 Aug 2019 16:09:09 -0700
Subject: [PATCH 6/8] nit: simplify equality check

---
 crypto/rsa_go.go | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/crypto/rsa_go.go b/crypto/rsa_go.go
index f8b5999..d774991 100644
--- a/crypto/rsa_go.go
+++ b/crypto/rsa_go.go
@@ -109,14 +109,7 @@ func (sk *RsaPrivateKey) Equals(k Key) bool {
 	b := other.sk
 
 	// Don't care about constant time. We're only comparing the public half.
-	if a.PublicKey.N.Cmp(b.PublicKey.N) != 0 {
-		return false
-	}
-	if a.PublicKey.E != b.PublicKey.E {
-		return false
-	}
-
-	return true
+	return a.PublicKey.N.Cmp(b.PublicKey.N) == 0 && a.PublicKey.E == b.PublicKey.E
 }
 
 // UnmarshalRsaPrivateKey returns a private key from the input x509 bytes

From 1e3fcd96e18cc990d8ebaf2e2bce8158e3ca0ea7 Mon Sep 17 00:00:00 2001
From: Steven Allen <steven@stebalien.com>
Date: Thu, 1 Aug 2019 16:35:45 -0700
Subject: [PATCH 7/8] dep: add back missing go.sum lines

---
 go.sum | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/go.sum b/go.sum
index e63e210..92469a4 100644
--- a/go.sum
+++ b/go.sum
@@ -74,8 +74,11 @@ github.com/libp2p/go-openssl v0.0.1 h1:hOIo7l0lXir9UzQE2zPxwd/Gdts1LFik0nqhbDZrG
 github.com/libp2p/go-openssl v0.0.1/go.mod h1:v8Zw2ijCSWBQi8Pq5GAixw6DbFfa9u6VIYDXnvOXkc0=
 github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329 h1:2gxZ0XQIU/5z3Z3bUBu+FXuk2pFbkN6tcwi/pjyaDic=
 github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.4 h1:bnP0vzxcAdeI1zdubAl5PjU6zsERjGZb7raWodagDYs=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b h1:j7+1HpAFS1zy5+Q4qx1fWh90gTKwiN4QCGoY9TWyyO4=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/minio/blake2b-simd v0.0.0-20160723061019-3f5f724cb5b1 h1:lYpkrQH5ajf0OXOcUbGjvZxxijuBwbbmlSxLiuofa+g=
 github.com/minio/blake2b-simd v0.0.0-20160723061019-3f5f724cb5b1/go.mod h1:pD8RvIylQ358TN4wwqatJ8rNavkEINozVn9DtGI3dfQ=
@@ -103,6 +106,7 @@ github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/sirupsen/logrus v1.2.0 h1:juTguoYk5qI21pwyTXY3B3Y5cOTH3ZUyZCg1v/mihuo=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/smola/gocompat v0.2.0 h1:6b1oIMlUXIpz//VKEDzPVBK8KG7beVwmHIUEBIs/Pns=
 github.com/smola/gocompat v0.2.0/go.mod h1:1B0MlxbmoZNo3h8guHp8HztB3BSYR5itql9qtVc0ypY=

From b47dbc0e29d683a720fa5af528424968e0744eb8 Mon Sep 17 00:00:00 2001
From: Steven Allen <steven@stebalien.com>
Date: Thu, 1 Aug 2019 16:42:13 -0700
Subject: [PATCH 8/8] dep: update go-openssl

Add freebsd/openbsd openssl support.
---
 go.mod | 2 +-
 go.sum | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/go.mod b/go.mod
index ff1b4ca..6700a83 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/jbenet/goprocess v0.1.3
 	github.com/libp2p/go-flow-metrics v0.0.1
 	github.com/libp2p/go-msgio v0.0.4
-	github.com/libp2p/go-openssl v0.0.1
+	github.com/libp2p/go-openssl v0.0.2
 	github.com/minio/sha256-simd v0.1.0
 	github.com/mr-tron/base58 v1.1.2
 	github.com/multiformats/go-multiaddr v0.0.4
diff --git a/go.sum b/go.sum
index 92469a4..c1bd54e 100644
--- a/go.sum
+++ b/go.sum
@@ -67,11 +67,11 @@ github.com/libp2p/go-buffer-pool v0.0.1/go.mod h1:xtyIz9PMobb13WaxR6Zo1Pd1zXJKYg
 github.com/libp2p/go-flow-metrics v0.0.1 h1:0gxuFd2GuK7IIP5pKljLwps6TvcuYgvG7Atqi3INF5s=
 github.com/libp2p/go-flow-metrics v0.0.1/go.mod h1:Iv1GH0sG8DtYN3SVJ2eG221wMiNpZxBdp967ls1g+k8=
 github.com/libp2p/go-msgio v0.0.4 h1:agEFehY3zWJFUHK6SEMR7UYmk2z6kC3oeCM7ybLhguA=
-github.com/libp2p/go-msgio v0.0.4/go.mod h1:63lBBgOTDKQL6EWazRMCwXsEeEeK9O2Cd+0+6OOuipQ=
 github.com/libp2p/go-msgio v0.0.4 h1:agEFehY3zWJFUHK6SEMR7UYmk2z6kC3oeCM7ybLhguA=
 github.com/libp2p/go-msgio v0.0.4/go.mod h1:63lBBgOTDKQL6EWazRMCwXsEeEeK9O2Cd+0+6OOuipQ=
-github.com/libp2p/go-openssl v0.0.1 h1:hOIo7l0lXir9UzQE2zPxwd/Gdts1LFik0nqhbDZrG8U=
-github.com/libp2p/go-openssl v0.0.1/go.mod h1:v8Zw2ijCSWBQi8Pq5GAixw6DbFfa9u6VIYDXnvOXkc0=
+github.com/libp2p/go-msgio v0.0.4/go.mod h1:63lBBgOTDKQL6EWazRMCwXsEeEeK9O2Cd+0+6OOuipQ=
+github.com/libp2p/go-openssl v0.0.2 h1:9pP2d3Ubaxkv7ZisLjx9BFwgOGnQdQYnfcH29HNY3ls=
+github.com/libp2p/go-openssl v0.0.2/go.mod h1:v8Zw2ijCSWBQi8Pq5GAixw6DbFfa9u6VIYDXnvOXkc0=
 github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329 h1:2gxZ0XQIU/5z3Z3bUBu+FXuk2pFbkN6tcwi/pjyaDic=
 github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=