From f497a74ec4a0321d5b4e51b87d808923174f67b1 Mon Sep 17 00:00:00 2001
From: orignal <i2porignal@yandex.ru>
Date: Tue, 21 Jan 2020 12:18:31 -0500
Subject: [PATCH] set random two highest bits

---
 libi2pd/Elligator.cpp | 13 ++++++++++---
 libi2pd/Elligator.h   |  2 +-
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/libi2pd/Elligator.cpp b/libi2pd/Elligator.cpp
index b9471512..bd9c382f 100644
--- a/libi2pd/Elligator.cpp
+++ b/libi2pd/Elligator.cpp
@@ -1,3 +1,4 @@
+#include <openssl/rand.h>
 #include "Crypto.h"
 #include "Elligator.h"
 
@@ -39,8 +40,8 @@ namespace crypto
 		BN_free (u); BN_free (iu); 
 	}
 
-	bool Elligator2::Encode (const uint8_t * key, uint8_t * encoded, bool highY) const
-	{
+	bool Elligator2::Encode (const uint8_t * key, uint8_t * encoded) const
+    {
 		bool ret = true;
 		BN_CTX * ctx = BN_CTX_new ();
 		BN_CTX_start (ctx);
@@ -61,7 +62,11 @@ namespace crypto
 		BN_mod_mul (uxxA, uxxA, xA, p, ctx);	
 		
 		if (Legendre (uxxA, ctx) != -1)
-		{		
+		{	
+            uint8_t randByte; // random highest bits and high y
+            RAND_bytes (&randByte, 1);
+            bool highY = randByte & 0x01;
+    	
 			BIGNUM * r = BN_CTX_get (ctx);
 			if (highY)
 			{
@@ -78,6 +83,7 @@ namespace crypto
 			SquareRoot (r, r, ctx);
 			bn2buf (r, encoded, 32);
 		
+            encoded[0] |= (randByte & 0xC0); // copy two highest bits from randByte
 			for (size_t i = 0; i < 16; i++) // To Little Endian
 			{
 				uint8_t tmp = encoded[i];
@@ -105,6 +111,7 @@ namespace crypto
 			encoded1[i] = encoded[31 - i];
 			encoded1[31 - i] = encoded[i];
 		}
+        encoded1[0] &= 0x3F; // drop two highest bits
 
 		BIGNUM * r = BN_CTX_get (ctx); BN_bin2bn (encoded1, 32, r);
 
diff --git a/libi2pd/Elligator.h b/libi2pd/Elligator.h
index ca463568..6f9eaf2a 100644
--- a/libi2pd/Elligator.h
+++ b/libi2pd/Elligator.h
@@ -17,7 +17,7 @@ namespace crypto
 			Elligator2 ();
 			~Elligator2 ();
 
-			bool Encode (const uint8_t * key, uint8_t * encoded, bool highY = false) const;
+			bool Encode (const uint8_t * key, uint8_t * encoded) const;
 			bool Decode (const uint8_t * encoded, uint8_t * key) const;
 
 		private: