---
id: RUSTSEC-2026-0240
aliases:
  - GHSA-7j32-2mpw-c784
title: Ed25519 identity public keys permit universal signature forgery
summary: Ed25519 identity public keys permit universal signature forgery
severity: none
vendor: dcrypt-sign
product: dcrypt-sign
ecosystem: rust
affected:
  - 'dcrypt-sign >= 0.0.0-0, < 2.0.0'
patched:
  - dcrypt-sign 2.0.0
published: '2026-08-09'
updated: '2026-08-09'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0240'
references:
  - url: 'https://crates.io/crates/dcrypt-sign'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0240.html'
  - url: >-
      https://github.com/ioi-foundation/dcrypt/security/advisories/GHSA-7j32-2mpw-c784
  - url: >-
      https://github.com/ioi-foundation/dcrypt/commit/c99cc86f0ee353010cd202cbcd2c310371b0bbb8
  - url: 'https://github.com/ioi-foundation/dcrypt/releases/tag/v2.0.0'
tags:
  - osv
  - rust
ingestedAt: '2026-08-09T19:16:06.127Z'
---

## Overview

All published versions of `dcrypt-sign` before 2.0.0 accepted the Edwards
identity as an Ed25519 public key. A signature with `R = B` and `S = 1` then
verified for every message because the challenge term multiplied the identity.
The implementation also admitted other noncanonical or small-order inputs.
Consumers that accepted externally supplied dcrypt Ed25519 keys may therefore
have accepted forged authorizations.

Version 2.0.0 replaces the custom arithmetic with `ed25519-dalek`, uses strict
verification, and rejects noncanonical, small-order, and non-torsion-free public
keys and `R` values, as well as noncanonical `S >= L`. No wrapper around the
affected verifier is recommended as a complete workaround. Upgrade to 2.0.0 or
later, audit registered keys and trust stores, and review historical actions
authorized with externally supplied keys.

## Affected packages

- `dcrypt-sign >= 0.0.0-0, < 2.0.0`

## Remediation

Upgrade to a patched release:

- `dcrypt-sign 2.0.0`