Giters

MystenLabs / ed25519-unsafe-libs

List of unsafe ed25519 signature libs

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

is this usage of elliptic js lib concerning?

stocks29 opened this issue · comments

commented

Thanks for the feedback. You are correct!
There will be another list of vulnerable libs for which although their sign api is safe, they do allow generating keypairs from uncoupled, potentially unmatched, private and public key material. elliptic will unfortunately be enlisted in the second wave of vulnerable apis due to this. I'll keep this issue open and reference it when the second list is ready (soonish).

Btw, we mention this type of vulnerability in this Reddit post, see sub-points in last bullet-point and we'll need your contribution to find similar libs. Amazing input, thanks!