Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Verify Signatures are in the correct Sub-group #80

Closed
kirk-baird opened this issue Oct 17, 2019 · 4 comments
Closed

Verify Signatures are in the correct Sub-group #80

kirk-baird opened this issue Oct 17, 2019 · 4 comments

Comments

@kirk-baird
Copy link
Contributor

  • py-ecc Version: 1.7.1

What is wrong?

Currently verification of a signature does not check that the signature is in the correct subgroup. This poses a security risk when verifying a pairing.

How can it be fixed

When verifying a signature check r * sig == 0 before pairing.

I will update #79 to include the check as this had been inserted into the standard.
@pipermerriam
Copy link
Member

If this isn't explicitely part of #79 maybe this change can be extracted to a stand-alone PR?

@kirk-baird
Copy link
Contributor Author

I made this PR cause it is a security vulnerability that currently exists but it is included as part or the BLS stand.

Do you this it should be it's own PR or part of the BLS standard PR?

@kirk-baird
Copy link
Contributor Author

I've added this in #79

pacrob added a commit to pacrob/py_ecc that referenced this issue Oct 29, 2023
@pacrob
template cleanup following initial merge with py-evm (ethereum#80)
431db89 
* template cleanup following initial merge with py-evm

* add flake8 pin comment

* correct license years

* add pin note to mypy
@kclowes
Copy link
Contributor

kclowes commented Oct 21, 2024

Closed via #79

@kclowes kclowes closed this as completed Oct 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@pipermerriam @kclowes @kirk-baird