hsec-2025-0002

osv_haskell
Description

# Double Public Key Signing Function Oracle Attack on Ed25519 The standard specification of Ed25519 message signing involves providing the algorithm with a message and private key. The function will use the private key to compute the public key and sign the message. Some libraries provide a variant of the message signing function that also takes the pre-computed public key as an input parameter. Libraries that allow arbitrary public keys as inputs without checking if the input public key corresponds to the input private key are vulnerable to the following attack. By using several public keys and messages, a malicious user with access to the signing mechanism may build up insights into the private key parameters resulting in access to the private key. This shortcoming means that an attacker could use the signing function as an Oracle, perform crypto-analysis and ultimately get at secrets. For example, an attacker who can’t access the private key but can access the signing mechanism through an API call could use several public keys and messages to gradually build up insights into private key parameters.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2025/HSEC-2025-0002.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2025/HSEC-2025-0002.json",
        "source": "https://github.com/haskell/security-advisories/blob/generated/osv-export/2025/HSEC-2025-0002.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "cryptonite",
        "purl": "pkg:hackage/cryptonite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "type": "CVSS_V3"
        }
      ],
      "versions": [
        "0.1",
        "0.10",
        "0.11",
        "0.12",
        "0.13",
        "0.14",
        "0.15",
        "0.15.1",
        "0.16",
        "0.17",
        "0.18",
        "0.19",
        "0.2",
        "0.20",
        "0.21",
        "0.22",
        "0.23",
        "0.24",
        "0.25",
        "0.26",
        "0.27",
        "0.28",
        "0.29",
        "0.3",
        "0.30",
        "0.4",
        "0.5",
        "0.6",
        "0.7",
        "0.8",
        "0.9"
      ]
    },
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2025/HSEC-2025-0002.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2025/HSEC-2025-0002.json",
        "source": "https://github.com/haskell/security-advisories/blob/generated/osv-export/2025/HSEC-2025-0002.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "crypton",
        "purl": "pkg:hackage/crypton"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.31"
            },
            {
              "fixed": "1.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "type": "CVSS_V3"
        }
      ],
      "versions": [
        "0.31",
        "0.32",
        "0.33",
        "0.34",
        "1.0.0",
        "1.0.1",
        "1.0.2"
      ]
    }
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# Double Public Key Signing Function Oracle Attack on Ed25519\n\nThe standard specification of Ed25519 message signing involves providing the\nalgorithm with a message and private key.\n\nThe function will use the private key to compute the public key and sign the message.\nSome libraries provide a variant of the message signing function that also takes\nthe pre-computed public key as an input parameter.\n\nLibraries that allow arbitrary public keys as inputs without checking if the\ninput public key corresponds to the input private key are vulnerable to the\nfollowing attack.\n\nBy using several public keys and messages, a malicious user with access to the\nsigning mechanism may build up insights into the private key parameters\nresulting in access to the private key.\n\nThis shortcoming means that an attacker could use the signing function as an\nOracle, perform crypto-analysis and ultimately get at secrets.\nFor example, an attacker who can’t access the private key but can access\nthe signing mechanism through an API call could use several public keys and\nmessages to gradually build up insights into private key parameters.\n",
  "id": "HSEC-2025-0002",
  "modified": "2026-04-18T18:31:14.236075Z",
  "published": "2025-11-14T14:45:34Z",
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://web.archive.org/web/20250917120037/https://portswigger.net/daily-swig/dozens-of-cryptography-libraries-vulnerable-to-private-key-theft"
    },
    {
      "type": "ARTICLE",
      "url": "https://github.com/MystenLabs/ed25519-unsafe-libs"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-w5vr-6qhr-36cc"
    },
    {
      "type": "EVIDENCE",
      "url": "https://hackage.haskell.org/package/cryptonite-0.30/docs/src/Crypto.PubKey.Ed25519.html#sign"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/haskell-crypto/cryptonite/blob/cryptonite-v0.30/cbits/ed25519/ed25519.c#53"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/kazu-yamamoto/crypton/blob/48fb9df2de5ee752196724b081f4d3cdb57576ed/cbits/ed25519/ed25519.c#L53"
    },
    {
      "type": "FIX",
      "url": "https://github.com/kazu-yamamoto/crypton/pull/47"
    }
  ],
  "related": [
    "GHSA-w5vr-6qhr-36cc"
  ],
  "schema_version": "1.7.5",
  "summary": "Double Public Key Signing Function Oracle Attack on Ed25519"
}
View JSON API Download JSON