{"id":"RUSTSEC-2026-0240","aliases":["GHSA-7j32-2mpw-c784"],"title":"Ed25519 identity public keys permit universal signature forgery","summary":"Ed25519 identity public keys permit universal signature forgery","severity":"none","vendor":"dcrypt-sign","product":"dcrypt-sign","ecosystem":"rust","affected":["dcrypt-sign >= 0.0.0-0, < 2.0.0"],"patched":["dcrypt-sign 2.0.0"],"published":"2026-08-09","updated":"2026-08-09","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0240","references":[{"url":"https://crates.io/crates/dcrypt-sign"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0240.html"},{"url":"https://github.com/ioi-foundation/dcrypt/security/advisories/GHSA-7j32-2mpw-c784"},{"url":"https://github.com/ioi-foundation/dcrypt/commit/c99cc86f0ee353010cd202cbcd2c310371b0bbb8"},{"url":"https://github.com/ioi-foundation/dcrypt/releases/tag/v2.0.0"}],"tags":["osv","rust"],"ingestedAt":"2026-08-09T19:16:06.127Z","slug":"RUSTSEC-2026-0240","body":"## Overview\n\nAll published versions of `dcrypt-sign` before 2.0.0 accepted the Edwards\nidentity as an Ed25519 public key. A signature with `R = B` and `S = 1` then\nverified for every message because the challenge term multiplied the identity.\nThe implementation also admitted other noncanonical or small-order inputs.\nConsumers that accepted externally supplied dcrypt Ed25519 keys may therefore\nhave accepted forged authorizations.\n\nVersion 2.0.0 replaces the custom arithmetic with `ed25519-dalek`, uses strict\nverification, and rejects noncanonical, small-order, and non-torsion-free public\nkeys and `R` values, as well as noncanonical `S >= L`. No wrapper around the\naffected verifier is recommended as a complete workaround. Upgrade to 2.0.0 or\nlater, audit registered keys and trust stores, and review historical actions\nauthorized with externally supplied keys.\n\n## Affected packages\n\n- `dcrypt-sign >= 0.0.0-0, < 2.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `dcrypt-sign 2.0.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}