fix DSC Key Smuggling via Unsigned TBS Data [LA-A]

[x-senpai-x]

Summary

Adds a check_zero_padding(tbs_certificate, tbs_certificate_len) constraint in t_add_dsc_verify_1300 immediately after the length bounds check
Imports utils::check_zero_padding, which already exists and is used in the 720-byte path

Background

The 1300-byte DSC registration circuit splits SHA-256 hashing across two sub-circuits (t_add_dsc_hash_1300 + t_add_dsc_verify_1300) using a pre-computed hash. Unlike the 720-byte path — which calls sig_check_rsa::verify_signature → sha256_and_check_data_to_sign → check_zero_padding automatically — the 1300-byte path passes a pre-computed msg_hash: [u8; 32] directly to fragmented_sig_check_rsa::verify_rsa_signature, which never sees the raw TBS buffer. This meant the zero-padding guard was never applied.

[Copilot]

Pull request overview

Adds a missing zero-padding constraint to the 1300-byte DSC verification circuit so that bytes past the signed TBS length cannot be prover-controlled when computing commitments/signature checks.

Changes:

• Import utils::check_zero_padding in t_add_dsc_verify_1300.
• Enforce check_zero_padding(tbs_certificate, tbs_certificate_len) immediately after the existing length upper-bound check.
• Add a clarifying comment explaining the rationale for the constraint.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.