PT-2023-33022 · Tss-Lib · Tss-Lib

Published 2023-09-01 · Updated 2023-09-01

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions tss-lib (affected versions not specified)

Description The GG18 threshold ECDSA signature protocol specification contains an issue that allows an attacker to recover the shared secret key. This can occur when a participant generates a Paillier modulus N with small factors, enabling them to steal other participants' secret key shares through the signing protocol. The master key can then be reconstructed from these shares.

Recommendations To address the issue, the implementation of GG18 in tss-lib should be updated to include proofs that N is biprime and does not contain small factors, as per the CGGMP21 threshold ECDSA protocol. Specifically, the updated implementation should include:

• Paillier-Blum Modulus proof to ensure N is the product of two primes
• No Small Factor proof to ensure both factors of N are greater than 2^256 An additional round should be added to the resharing protocol to allow participants to confirm receipt of valid proofs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-H24C-6P6P-M3VX

Affected Products

Tss-Lib

References · 6

• https://osv.dev/vulnerability/GHSA-h24c-6p6p-m3vx · Vendor Advisory
• https://github.com/threshold-network/tss-lib/security/advisories/GHSA-h24c-6p6p-m3vx · Note
• https://github.com/threshold-network/tss-lib · Note
• https://github.com/threshold-network/tss-lib/commit/2e712689cfbeefede15f95a0ec7112227d86f702 · Note
• https://eprint.iacr.org/2021/060 · Note
• https://eprint.iacr.org/2019/114 · Note