Fix decryption error when c5 has leading zeroes
@@ -234,6 +234,7 @@ private void initCipherDecrypt(McElieceCCA2PrivateKeyParameters privKey)
int c2Len = messDigest.getDigestSize();
int c4Len = k >> 3;
+ int c5Len = (IntegerFunctions.binomial(n, t).bitLength() - 1) >> 3;
int c6Len = input.length - nDiv8;
// split cipher text (c6||encC4), where c6 may be empty
@@ -269,6 +270,13 @@ private void initCipherDecrypt(McElieceCCA2PrivateKeyParameters privKey)
// compute c5 = Conv^-1(z)
byte[] c5 = Conversions.decode(n, t, z);
+ // if c5 is shorter than expected, pad with leading zeroes
+ if (c5.length < c5Len) {
+ byte[] paddedC5 = new byte[c5Len];
+ System.arraycopy(c5, 0, paddedC5, c5Len - c5.length, c5.length);
+ c5 = paddedC5;
+ }
+
// compute (c6||c5||c4)
byte[] c6c5c4 = ByteUtils.concatenate(c6, c5);
c6c5c4 = ByteUtils.concatenate(c6c5c4, c4);
