Reported

August 9, 2026

Issued

August 9, 2026

Package

dcrypt-sign (crates.io)

Type

Vulnerability

Categories

• crypto-failure

Keywords

#ed25519 #identity-key #signature-forgery

Aliases

• GHSA-7j32-2mpw-c784

References

• https://github.com/ioi-foundation/dcrypt/security/advisories/GHSA-7j32-2mpw-c784
• https://github.com/ioi-foundation/dcrypt/commit/c99cc86f0ee353010cd202cbcd2c310371b0bbb8
• https://github.com/ioi-foundation/dcrypt/releases/tag/v2.0.0

Patched

• >=2.0.0

Description

All published versions of dcrypt-sign before 2.0.0 accepted the Edwards identity as an Ed25519 public key. A signature with R = B and S = 1 then verified for every message because the challenge term multiplied the identity. The implementation also admitted other noncanonical or small-order inputs. Consumers that accepted externally supplied dcrypt Ed25519 keys may therefore have accepted forged authorizations.

Version 2.0.0 replaces the custom arithmetic with ed25519-dalek, uses strict verification, and rejects noncanonical, small-order, and non-torsion-free public keys and R values, as well as noncanonical S >= L. No wrapper around the affected verifier is recommended as a complete workaround. Upgrade to 2.0.0 or later, audit registered keys and trust stores, and review historical actions authorized with externally supplied keys.

Advisory available under CC0-1.0 license.