- Reported
-
- Issued
-
- Package
-
bsv-rs
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#bitcoin
#shamir
#backup
#secret-sharing
#key-recovery
- Aliases
-
- References
-
- CVSS Score
- 9.1
CRITICAL
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality Impact
- High
- Integrity Impact
- High
- Availability Impact
- None
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Patched
-
>=0.8.7, <0.9.0-beta.1>0.9.0-beta.7
- Affected Functions
- Version
bsv_rs::primitives::bsv::shamir::KeyShares::from_backup_format-
>=0.2.0, <0.8.7>=0.9.0-beta.1, <=0.9.0-beta.7
bsv_rs::primitives::bsv::shamir::KeyShares::recover_private_key-
>=0.2.0, <0.8.7>=0.9.0-beta.1, <=0.9.0-beta.7
Description
KeyShares::from_backup_format (the Shamir backup share reader, public since
0.2.0, the crate's first release) accepted a share whose x coordinate is 0,
and KeyShares::recover_private_key interpolates the shares at x = 0 to
recover the key. At an x of 0 the interpolation answers that share's y value
alone, so an attacker who supplies one share in that form — with the share's
integrity tag ground to match the honest set's — chooses the recovered key
outright. The non-canonical zero x = p works the same way, and a repeated x
past the threshold window also passed.
An application that recovers a Shamir backup from shares it did not produce —
a custodian's medium, a share pasted by hand, a set restored from another
writer — could be handed the attacker's key as the recovered one. A set the
crate's own writer produces never carries such a share; the door is the
reader.
0.8.7 refuses such a set before interpolating (the 0.9 line's next prerelease
carries the same refusal). Where upgrading is not possible, before recovering
split each share on . into four fields, base58-decode the x field, and
refuse the set if it decodes to zero (the one-character field 1, or a value
at or above the field prime) or if two shares carry the same x.
Advisory available under CC0-1.0
license.