CVE-2023-26556

2023-04-2100:00:00

mitre

www.cve.org

io.finnet tss-lib

secret key leak

timing side-channel

scalar-multiplication

go crypto/elliptic

ecdsa/keygen/round_2.go

bnb-chain/tss-lib

thorchain/tss

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.6%

JSON

io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if statement in a loop). One leak is in ecdsa/keygen/round_2.go. (bnb-chain/tss-lib and thorchain/tss are also affected.)