CVE-2023-26556: IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar multiplication
(updated )
io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if statement in a loop). One leak is in ecdsa/keygen/round_2.go. (bnb-chain/tss-lib and thorchain/tss are also affected.)
References
- github.com/IoFinnet/tss-lib/releases/tag/v2.0.0
- github.com/advisories/GHSA-3w84-4mjc-rjw7
- github.com/bnb-chain/tss-lib
- github.com/bnb-chain/tss-lib/issues/44
- github.com/bnb-chain/tss-lib/releases/tag/v2.0.0
- github.com/bnb-chain/tss-lib/tree/v1.3.5
- gitlab.com/thorchain/tss/tss-lib/-/tags/v0.1.3
- medium.com/@iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b
- nvd.nist.gov/vuln/detail/CVE-2023-26556
- pkg.go.dev/vuln/GO-2023-1732
Code Behaviors & Features
Detect and mitigate CVE-2023-26556 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →