Apply Loup's feedback

diff --git a/doc/man/man3/crypto_lock_init.3monocypher b/doc/man/man3/crypto_lock_init.3monocypher
index db38f5206b6a7b54bacbdfb7118ab801b3088803..c9371c438aa60365ee9cb0fecf21ff7c3a2b644c 100644 (file)
--- a/doc/man/man3/crypto_lock_init.3monocypher
+++ b/doc/man/man3/crypto_lock_init.3monocypher
@@ -235,10 +235,9 @@ XChacha20 derives from Chacha20 the same way XSalsa20 derives from
 Salsa20, and benefits from the same security reduction (proven secure
 as long as Chacha20 itself is secure).
 .Sh SECURITY CONSIDERATIONS
-Messages must be completely decrypted before they can be verified.
-Make sure to call
-.Fn crypto_unlock_final ,
-and make sure to check its return value
+Messages are not verified until the call to
+.Fn crypto_unlock_final .
+Make sure to call it and check the return value
 .Em before
 processing the message.
 Messages may be stored before they are verified, but they cannot be

diff --git a/doc/man/man3/crypto_sign_init_first_pass.3monocypher b/doc/man/man3/crypto_sign_init_first_pass.3monocypher
index 3797fda7449d0ed4c5c05ff86b76d0fb8d0a7ae4..f96faead3cdc6b7023e2889c205829fa540fe63d 100644 (file)
--- a/doc/man/man3/crypto_sign_init_first_pass.3monocypher
+++ b/doc/man/man3/crypto_sign_init_first_pass.3monocypher
@@ -168,7 +168,7 @@ This is the same as Ed25519, with Blake2b instead of SHA-512.
 Ed25519 is described in RFC 7748.
 .Sh SECURITY CONSIDERATIONS
 Messages are not verified until the call to
-.Xr crypto_check_final .
+.Fn crypto_check_final .
 Messages may be stored before they are verified, but they cannot be
 .Em trusted .
 Processing untrusted messages increases the attack surface of the
@@ -176,9 +176,10 @@ system.
 Doing so securely is hard.
 Do not process messages before calling
 .Fn crypto_check_final .
-Additionally, the security considerations documented in
-.Xr crypto_sign 3monocypher ,
-apply here too.
+.Pp
+When signing messages, the security considerations documented in
+.Xr crypto_sign 3monocypher
+also apply.
 .Sh IMPLEMENTATION DETAILS
 EdDSA signatures require two passes that cannot be performed in
 parallel.