Double Public Key Signing Function Oracle Attack on Ed25519 in Cryptonite and Crypton Packages
Summary
HSEC-2025-0002: Double Public Key Signing Function Oracle Attack on Ed25519. Affects cryptonite versions >= 0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cryptonite and Crypton are Haskell libraries that provide cryptographic functions, including secure message signing using the Ed25519 algorithm. These libraries are widely used for their efficiency and security in handling cryptographic operations. However, they are vulnerable to a specific attack due to the way they handle public key inputs during the signing process.
Vulnerability Detail
The vulnerability arises from the implementation of the Ed25519 signing function, which allows arbitrary public keys as inputs without verifying if they correspond to the provided private key. This flaw enables a malicious user to exploit the signing mechanism as an oracle, gaining insights into the private key parameters through repeated signing attempts with different public keys and messages. The potential ramifications include unauthorized access to sensitive data and compromise of cryptographic security, as attackers can gradually deduce the private key.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the signing function that allows arbitrary public keys as inputs. Instead, use the standard signing function that computes the public key internally from the private key, ensuring that the integrity of the signing process is maintained.
Conclusion
The vulnerability in the Cryptonite and Crypton packages poses a significant risk due to the improper handling of public keys in the Ed25519 signing function. It is crucial to update to the patched versions to mitigate the risk of unauthorized access to private keys. Implementing the recommended fixes and workarounds will help secure your applications against potential attacks.
See every vulnerability recorded for cryptonite →
FAQ
Ed25519 is a public-key signature system that is designed for high performance and security. It is widely used in various applications for secure message signing.
If your application uses the vulnerable versions of Cryptonite or Crypton, it may be susceptible to attacks that can compromise the private keys used for signing messages.
If immediate updates are not possible, implement the workaround by avoiding the use of the vulnerable signing function that accepts arbitrary public keys.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
For more details, you can refer to the official security advisories on GitHub or visit the Vulert website for real-time monitoring of vulnerabilities.
