Skip to content

Commit

Permalink
Add advisory for unambigious challenge derivation in cggmp21 (#2012)
Browse files Browse the repository at this point in the history
  • Loading branch information
survived authored Nov 10, 2024
1 parent b1254e8 commit 6c89070
Show file tree
Hide file tree
Showing 3 changed files with 57 additions and 0 deletions.
19 changes: 19 additions & 0 deletions crates/cggmp21-keygen/RUSTSEC-0000-0000.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"

package = "cggmp21-keygen"
date = "2024-07-18"
url = "https://github.com/dfns/cggmp21/pull/103"
categories = ["crypto-failure"]

keywords = ["mpc", "tss", "zkp"]

[versions]
patched = [">= 0.3.0"]
```

# Ambiguous challenge derivation

Challenge derivation in non-interactive ZK proofs was ambiguous and that could lead
to security vulnerability (however, it's unknown if it could be exploited).
19 changes: 19 additions & 0 deletions crates/cggmp21/RUSTSEC-0000-0000.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"

package = "cggmp21"
date = "2024-07-18"
url = "https://github.com/dfns/cggmp21/pull/103"
categories = ["crypto-failure"]

keywords = ["mpc", "tss", "zkp"]

[versions]
patched = [">= 0.4.0"]
```

# Ambiguous challenge derivation

Challenge derivation in non-interactive ZK proofs was ambiguous and that could lead
to security vulnerability (however, it's unknown if it could be exploited).
19 changes: 19 additions & 0 deletions crates/paillier-zk/RUSTSEC-0000-0000.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"

package = "paillier-zk"
date = "2024-07-18"
url = "https://github.com/dfns/paillier-zk/pull/49"
categories = ["crypto-failure"]

keywords = ["mpc", "tss", "zkp"]

[versions]
patched = [">= 0.4.0"]
```

# Ambiguous challenge derivation

Challenge derivation in non-interactive ZK proofs was ambiguous and that could lead
to security vulnerability (however, it's unknown if it could be exploited).

0 comments on commit 6c89070

Please sign in to comment.