View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0010139 | Taler | wallet-core | public | 2025-06-29 11:04 | 2026-09-19 14:40 |
| Reporter | oec | Assigned To | Florian Dold | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | high | Severity | minor | Reproducibility | have not tried |
| Status | informing | Resolution | fixed | ||
| Product Version | git (master) | ||||
| Target Version | 1.6 | Fixed in Version | 1.6 | ||
| Summary | 0010139: Check if nacl-fast.ts is affected by ed25519 verification malleability | ||||
| Description | According to https://github.com/dchest/tweetnacl-js/issues/253 , "ed25519 verification is malleable and accepts forged signatures": "tweetnacl ed25519 signature verification is malleable and does not have SUF-CMA (strong unforgeability under chosen message attacks). Malleability is problematic in blockchain context. MtGox was hacked because of it." It is not clear to me if this applies to the nacl-fast.ts implementation and its use in the context of wallet-core. This should be checked. | ||||
| Tags | No tags attached. | ||||
| This does not sound right. Not having SUF-CMA (and only EUF-CMA) will allow attackers to create different signatures of already seen messages. This probably does not affect taler at all. also AFAIR, EdDSA sigantures are always trivially malleable. Hence only EUF-CMA, which is a problem in blockchains as it will result in a different "transaction ID" | |
| Sorry my mistage. Of course common standardized EdDSA schemes are, in fact, SUF-CMA. The nacl implementation we use should follow the standard. It still holds that this malleability is (probably) not security relevant for us. | |
| Your link above is broken. For convenience https://github.com/dchest/tweetnacl-js/issues/253 | |
| Note the author of tweetnacl does not want to fix it. Maybe we can use a wasm-compiled libsodium? | |
| We might want to switch to https://www.npmjs.com/package/@noble/curves | |
| Noble is better audited and not affected by the ed25519 verification malleability. commit 6f1e8504ac78bb2d47d5cb7a9f046151c1d383d5 (HEAD -> master, origin/master, origin/HEAD) Author: Florian Dold <dold@taler.net> Date: Mon Aug 31 16:28:01 2026 +0200 taler-util: replace TweetNaCl with Noble | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2025-06-29 11:04 | oec | New Issue | |
| 2025-06-29 15:15 | schanzen | Note Added: 0025378 | |
| 2025-06-29 15:16 | schanzen | Note Edited: 0025378 | |
| 2025-06-29 15:26 | schanzen | Note Added: 0025379 | |
| 2025-07-03 10:52 | schanzen | Note Added: 0025393 | |
| 2025-07-03 10:55 | schanzen | Note Added: 0025394 | |
| 2025-07-06 14:11 | oec | Description Updated | |
| 2026-01-25 11:32 | Christian Grothoff | Status | new => implementing |
| 2026-08-31 13:46 | Florian Dold | Note Added: 0029787 | |
| 2026-08-31 14:40 | Florian Dold | Assigned To | => Florian Dold |
| 2026-08-31 14:40 | Florian Dold | Status | implementing => informing |
| 2026-08-31 14:40 | Florian Dold | Resolution | open => fixed |
| 2026-08-31 14:40 | Florian Dold | Note Added: 0029792 | |
| 2026-09-19 14:38 | Christian Grothoff | Target Version | post-1.0 => 1.6 |
| 2026-09-19 14:40 | Christian Grothoff | Fixed in Version | => 1.6 |