Skip to content

cc: fix ed25519 signatures malleability#632

Merged
DeckerSU merged 4 commits intodevfrom
patch-cc-ed25519-verify
Oct 3, 2024
Merged

cc: fix ed25519 signatures malleability#632
DeckerSU merged 4 commits intodevfrom
patch-cc-ed25519-verify

Conversation

@DeckerSU
Copy link
Copy Markdown

@DeckerSU DeckerSU commented Oct 2, 2024 •
edited
Loading

cc: fix ed25519 signatures malleability

Actually, the current CC code doesn’t use Ed25519 signatures, so CVE-2024-45193 has no impact on Komodo (KMD) or any existing assetchains. However, since CC could potentially use these types of signatures in the future (e.g., for newly developed CCs), we’ve added a 0 <= s < L check to prevent signature malleability.

Tests: afcb471

Before changes:

testing signature malleability
Signature:
0f 03 c0 e6 2c 38 ed 29
48 26 93 38 07 4a 25 f7
75 e1 db ce 6f 7d da 02
c6 c3 fd da 4c 7d d4 6b
bb f9 d4 06 5b fe 1f ff
34 1f 93 6d 7e ab 2b b5
a9 4a 88 23 3d 8f 7f 92
e2 3c 44 6b 7d 94 8e 07
valid signature
Modified signature:
0f 03 c0 e6 2c 38 ed 29
48 26 93 38 07 4a 25 f7
75 e1 db ce 6f 7d da 02
c6 c3 fd da 4c 7d d4 6b
a8 cd ca 63 75 61 32 57
0b bc 8a 10 5d a5 0a ca
a9 4a 88 23 3d 8f 7f 92
e2 3c 44 6b 7d 94 8e 17
valid signature

After changes:

testing signature malleability
Signature:
d7 08 b2 73 a3 41 95 7f
43 22 a6 47 48 dd 1a f9
9d f3 03 46 0b 06 e4 a0
ef 17 c9 bd 38 5b 95 49
d1 02 d8 bb 8a eb af 81
d6 28 db 15 2f e2 92 7a
d5 ad ae 7b 8c 2b df f8
7f d8 4b a8 18 3f 60 05
valid signature
Modified signature:
d7 08 b2 73 a3 41 95 7f
43 22 a6 47 48 dd 1a f9
9d f3 03 46 0b 06 e4 a0
ef 17 c9 bd 38 5b 95 49
be d6 cd 18 a5 4e c2 d9
ac c5 d2 b8 0d dc 71 8f
d5 ad ae 7b 8c 2b df f8
7f d8 4b a8 18 3f 60 15
invalid signature

TODO:

  • Test all CC-enabled chains to ensure they are perfectly synced from scratch with the new changes.
  • CCL
  • CLC
  • DOC
  • ILN
  • MARTY

@DeckerSU
cc: fix ed25519 signatures malleability
83011b2 
- #630
- https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/#vuln-ed25519

Actually, the current CC code doesn’t use Ed25519 signatures, so `CVE-2024-45193` has no impact on Komodo (KMD) or any existing assetchains. However, since CC could potentially use these types of signatures in the future (e.g., for newly developed CCs), we’ve added a `0 <= s < L` check to prevent signature malleability.
@DeckerSU
add ed25519 signature malleability test
afcb471
@DeckerSU DeckerSU requested review from dimxy and smk762 October 2, 2024 15:01
@DeckerSU DeckerSU linked an issue Oct 2, 2024 that may be closed by this pull request
komodo master: 1 vulnerabilities (highest severity is: 5.3) #630
Closed
@DeckerSU
use int instead of size_t in 0 <= s < L check loop
e245176 
using a signed integer type (int) is preferable here,
to avoid potential issues with unsigned underflow.
dimxy
dimxy previously approved these changes Oct 2, 2024
View reviewed changes
Copy link
Copy Markdown
Collaborator

@dimxy dimxy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@DeckerSU DeckerSU mentioned this pull request Oct 2, 2024
Merged
6 tasks
@DeckerSU DeckerSU linked an issue Oct 2, 2024 that may be closed by this pull request
pytest-7.4.4-py3-none-any.whl: 1 vulnerabilities (highest severity is: 3.3) #631
Closed
@DeckerSU
Copy link
Copy Markdown
Author

DeckerSU commented Oct 2, 2024

Tested and merged in KomodoOcean codebase, we should do the same here.

@DeckerSU DeckerSU requested a review from dimxy October 3, 2024 05:19
dimxy
dimxy approved these changes Oct 3, 2024
View reviewed changes
Copy link
Copy Markdown
Collaborator

@dimxy dimxy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@DeckerSU DeckerSU merged commit 956650e into dev Oct 3, 2024
This was referenced Oct 3, 2024
Closed
Closed
@DeckerSU DeckerSU deleted the patch-cc-ed25519-verify branch October 5, 2024 14:06
TheComputerGenie pushed a commit to ComputerGenieCo/komodo that referenced this pull request Sep 12, 2025
@DeckerSU @TheComputerGenie
cc: fix ed25519 signatures malleability (GLEECBTC#632)
e109c87 
* cc: fix ed25519 signatures malleability

- GLEECBTC#630
- https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/#vuln-ed25519

Actually, the current CC code doesn’t use Ed25519 signatures, so `CVE-2024-45193` has no impact on Komodo (KMD) or any existing assetchains. However, since CC could potentially use these types of signatures in the future (e.g., for newly developed CCs), we’ve added a `0 <= s < L` check to prevent signature malleability.

* add ed25519 signature malleability test

* use int instead of size_t in 0 <= s < L check loop

using a signed integer type (int) is preferable here,
to avoid potential issues with unsigned underflow.

* cc: test, update pytest ver. requirement

addressed in GLEECBTC#631
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dimxy dimxy dimxy approved these changes

@smk762 smk762 Awaiting requested review from smk762

Assignees

No one assigned

Labels

under test/review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

pytest-7.4.4-py3-none-any.whl: 1 vulnerabilities (highest severity is: 3.3) komodo master: 1 vulnerabilities (highest severity is: 5.3)

2 participants

@DeckerSU @dimxy