Well, I was playing with -lucre, and at one point, it generated a payment
that the bank refused ("bad signature").  I tracked down the bug, which
gets tickled when the first byte of the coin signature is 0.

I've included a patch below.  Does anyone have an ftp site they can
volunteer for storing patches?  So far, there's this one, and the ones
Doug implied for BSDI.

   - Ian

diff --recursive --new-file -u ../dist-src/-lucre-0.8.1/u_sig.c ./-lucre-0.=
8.1/u_sig.c
--- ../dist-src/-lucre-0.8.1/u_sig.c=09Mon Jun 10 14:37:22 1996
+++ ./-lucre-0.8.1/u_sig.c=09Thu Jun 20 23:54:06 1996
@@ -136,15 +136,13 @@
     return NULL;
 }
=20
-/* XOR some of the bytes of n with the bytes of xor.
-   I really don't know how this is supposed to work if n and xor are
-   of different lengths... */
+/* XOR some of the bytes of n with the bytes of xor. */
 EC_Errno EC_U_xor_MPI(BIGNUM *n, BIGNUM *xor)
 {
     Byte *nbin;
     Byte *xorbin;
     UInt32 nlen, xorlen;
-    UInt32 i;
+    UInt32 i,j;
=20
     /* Convert to data */
=20
@@ -163,8 +161,10 @@
     BN_bn2bin(xor, xorbin);
=20
     /* Do the XOR */
-    for(i=3D8;i<nlen && i<xorlen;++i) {   /* Yes, that's 8 */
-=09nbin[i] ^=3D xorbin[i];
+    i =3D nlen; j =3D xorlen;
+    while(i>8 && j>0) {   /* Yes, that's 8 */
+=09--i; --j;
+=09nbin[i] ^=3D xorbin[j];
     }
=20
     /* Convert back to MPI */
diff --recursive --new-file -u ../dist-src/Makefile ./Makefile

.