Ed25519 identity public keys permit universal signature forgery

Overview

All published versions of dcrypt-sign before 2.0.0 accepted the Edwards identity as an Ed25519 public key. A signature with R = B and S = 1 then verified for every message because the challenge term multiplied the identity. The implementation also admitted other noncanonical or small-order inputs. Consumers that accepted externally supplied dcrypt Ed25519 keys may therefore have accepted forged authorizations.

Version 2.0.0 replaces the custom arithmetic with ed25519-dalek, uses strict verification, and rejects noncanonical, small-order, and non-torsion-free public keys and R values, as well as noncanonical S >= L. No wrapper around the affected verifier is recommended as a complete workaround. Upgrade to 2.0.0 or later, audit registered keys and trust stores, and review historical actions authorized with externally supplied keys.

Affected packages

• dcrypt-sign >= 0.0.0-0, < 2.0.0

Remediation

Upgrade to a patched release:

• dcrypt-sign 2.0.0