Incorrect validation of parties IDs leaks secret keys in Secret-sharing scheme in github.com/keep-network/keep-ecdsa
Summary
GHSA-gp6j-vx54-5pmf: Incorrect validation of parties IDs leaks secret keys in Secret-sharing scheme. Affects github.com/keep-network/keep-ecdsa versions < 1.8.1. Fixed in 1.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/keep-network/keep-ecdsa is a Go package that implements a threshold signature scheme. It utilizes a secret-sharing scheme to divide secrets into shares. The package relies on the Verifiable Secret Sharing scheme to generate shares from user IDs. However, the package does not adequately validate these IDs, leading to potential security vulnerabilities.
Vulnerability Detail
The vulnerability arises from the improper validation of parties IDs in the secret-sharing procedure. When malicious IDs are used, other users may inadvertently reveal their secrets. Additionally, the lack of validation for modularly equal user IDs can cause nodes to crash during key generation or resharing. The issue stems from the failure to validate party IDs modulo the curve order, allowing an attacker to set their ID equal to the order of the elliptic curve and receive the secret key as their share.
How To Fix
Minimum fixed version
1.8.1
This is the first release that contains the fix.
go get github.com/keep-network/keep-ecdsa@v1.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the incorrect validation of parties IDs in the secret-sharing scheme of github.com/keep-network/keep-ecdsa can lead to the leakage of secret keys and potential system crashes. It is crucial to update the dependency on binance-chain/tss-lib to the latest version to mitigate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/keep-network/keep-ecdsa →
FAQ
The vulnerability can lead to the leakage of secret keys in the secret-sharing scheme, compromising the security and confidentiality of the system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
The recommended fix is to update the dependency on binance-chain/tss-lib to the latest version, which includes the necessary fixes for the vulnerability.
No specific workarounds have been mentioned for this vulnerability.
For more information about this vulnerability, you can refer to the GitHub advisory database (https://github.com/github/advisory-database) and the GitHub advisory for this specific vulnerability (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-gp6j-vx54-5pmf/GHSA-gp6j-vx54-5pmf.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/keep-network/keep-ecdsa.
