40 unsafe ed25519 libs where private key can be leaked via signing api misuse

• ed25519-unsafe-libs

  5 212 3.8 Rust

  List of unsafe ed25519 signature libs

  

TL;DR A new audit report revealed that the signing api of many ed25519 libs (some of them very popular) unfortunately expects a public key as input. An attacker may extract the private key by requesting two different signatures for the same message and private key, but on purpose for a different public key. Applications should not expose this api publicly and should refactor it to protect devs against accidental api misuse. Read more: https://github.com/MystenLabs/ed25519-unsafe-libs and https://blog.safeheron.com/blog/safeheron-originals/analysis-on-ed25519-use-risks-your-wallet-private-key-can-be-stolen

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

Suggest a related project