Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Track attempts to sign with off-curve keys #11311

Open
t-nelson opened this issue Jul 31, 2020 · 0 comments
Open

Track attempts to sign with off-curve keys #11311

t-nelson opened this issue Jul 31, 2020 · 0 comments
Labels
security Pull requests that address a security vulnerability
Milestone

Comments

@t-nelson
Copy link
Contributor

Problem

Moving derived addresses off the ed25519 curve discards mathematical guarantees for what their capabilities are within the cryptosystem. We do the known checks to prevent these values being used to verify signatures. Observing someone doing so may indicate an attempted unknown attack. We should keep track of these events.

Proposed Solution

Get the appropriate error types surfaced from ed25519-dalek
Add logging, metrics and alerts

@mvines mvines added the security Pull requests that address a security vulnerability label Aug 18, 2020
@mvines mvines added this to the v1.4.0 milestone Aug 18, 2020
@mvines mvines modified the milestones: v1.4.0, v1.5.0 Oct 8, 2020
@mvines mvines modified the milestones: v1.5.0, v1.6.0 Dec 17, 2020
@mvines mvines modified the milestones: v1.6.0, v1.7.0 Mar 11, 2021
@mvines mvines modified the milestones: v1.7.0, v1.8.0 May 10, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security Pull requests that address a security vulnerability
Projects
None yet
Development

No branches or pull requests

2 participants