secp256k1-node is a Node.js binding for an Optimized C library for EC operations on curve secp256k1. In `elliptic`-based version, `loadUncompressedPublicKey` has a check that the public key is on the curve. Prior to versions 5.0.1, 4.0.4, and 3.8.1, however, `loadCompressedPublicKey` is missing that check. That allows the attacker to use public keys on low-cardinality curves to extract enough information to fully restore the private key from as little as 11 ECDH sessions, and very cheaply on compute power. Other operations on public keys are also affected, including e.g. `publicKeyVerify()` incorrectly returning `true` on those invalid keys, and e.g. `publicKeyTweakMul()` also returning predictable outcomes allowing to restore the tweak. Versions 5.0.1, 4.0.4, and 3.8.1 contain a fix for the issue.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Secp256k1-node Project |
|
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-2944 | secp256k1-node is a Node.js binding for an Optimized C library for EC operations on curve secp256k1. In `elliptic`-based version, `loadUncompressedPublicKey` has a check that the public key is on the curve. Prior to versions 5.0.1, 4.0.4, and 3.8.1, however, `loadCompressedPublicKey` is missing that check. That allows the attacker to use public keys on low-cardinality curves to extract enough information to fully restore the private key from as little as 11 ECDH sessions, and very cheaply on compute power. Other operations on public keys are also affected, including e.g. `publicKeyVerify()` incorrectly returning `true` on those invalid keys, and e.g. `publicKeyTweakMul()` also returning predictable outcomes allowing to restore the tweak. Versions 5.0.1, 4.0.4, and 3.8.1 contain a fix for the issue. |
 Github GHSA |
GHSA-584q-6j8j-r5pm | secp256k1-node allows private key extraction over ECDH |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 21 Oct 2024 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Secp256k1-node Project
Secp256k1-node Project secp256k1-node |
|
| CPEs | cpe:2.3:a:secp256k1-node_project:secp256k1-node:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Secp256k1-node Project
Secp256k1-node Project secp256k1-node |
|
| Metrics |
ssvc
|
Mon, 21 Oct 2024 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | secp256k1-node is a Node.js binding for an Optimized C library for EC operations on curve secp256k1. In `elliptic`-based version, `loadUncompressedPublicKey` has a check that the public key is on the curve. Prior to versions 5.0.1, 4.0.4, and 3.8.1, however, `loadCompressedPublicKey` is missing that check. That allows the attacker to use public keys on low-cardinality curves to extract enough information to fully restore the private key from as little as 11 ECDH sessions, and very cheaply on compute power. Other operations on public keys are also affected, including e.g. `publicKeyVerify()` incorrectly returning `true` on those invalid keys, and e.g. `publicKeyTweakMul()` also returning predictable outcomes allowing to restore the tweak. Versions 5.0.1, 4.0.4, and 3.8.1 contain a fix for the issue. | |
| Title | secp256k1-node vulnerable to private key extraction over ECDH | |
| Weaknesses | CWE-354 | |
| References |
|
|
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-10-21T16:44:50.415Z
Reserved: 2024-10-09T22:06:46.175Z
Link: CVE-2024-48930
Vulnrichment
Updated: 2024-10-21T16:43:53.095Z
NVD
Status : Awaiting Analysis
Published: 2024-10-21T16:15:03.607
Modified: 2024-10-21T17:09:45.417
Link: CVE-2024-48930
Redhat
No data.
OpenCVE Enrichment
No data.