GHSA-w5vr-6qhr-36cc

Suggest an improvement
Source
https://github.com/advisories/GHSA-w5vr-6qhr-36cc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-w5vr-6qhr-36cc/GHSA-w5vr-6qhr-36cc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w5vr-6qhr-36cc
Aliases
Published
2023-08-14T21:10:29Z
Modified
2023-11-08T04:23:37.976884Z
Summary
`ed25519-dalek` Double Public Key Signing Function Oracle Attack
Details

Versions of ed25519-dalek prior to v2.0 model private and public keys as separate types which can be assembled into a Keypair, and also provide APIs for serializing and deserializing 64-byte private/public keypairs.

Such APIs and serializations are inherently unsafe as the public key is one of the inputs used in the deterministic computation of the S part of the signature, but not in the R value. An adversary could somehow use the signing function as an oracle that allows arbitrary public keys as input can obtain two signatures for the same message sharing the same R and only differ on the S part.

Unfortunately, when this happens, one can easily extract the private key.

Revised public APIs in v2.0 of ed25519-dalek do NOT allow a decoupled private/public keypair as signing input, except as part of specially labeled "hazmat" APIs which are clearly labeled as being dangerous if misused.

Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-14T21:10:29Z"
}
References

Affected packages

crates.io / ed25519-dalek

Package

Name
ed25519-dalek
View open source insights on deps.dev
Purl
pkg:cargo/ed25519-dalek

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.0