CVE-2022-47930

CVE-2022-47930 affects IO FinNet tss-lib prior to 2.0.0. The root cause is that the parameter ssid used to define a session id is not applied through the MPC implementation, and the Schnorr proof of knowledge in sch.go does not utilize a session id, context, or random nonce when generating the ch...

CVE-2023-26556

CVE-2023-26556 affects io.finnet tss-lib prior to 2.0.0. The vulnerability arises from a timing side-channel leak in the scalar-multiplication code path used by ECDSA key generation, relying on Go’s crypto/elliptic implementation which is not constant time. Affected code path is identified in ecd...

CVE-2022-47931

CVE-2022-47931 affects IO FinNet tss-lib prior to 2.0.0, describing a collision of hash values in the library used for threshold ECDSA/EdDSA in multi-party signing. The connected documents identify the affected version range (before 2.0.0) and point to the v2.0.0 release as remediation, along wit...

CVE-2023-26557

io.finnet tss-lib before 2.0.0 is vulnerable to a timing side-channel that can leak the lambda value of a private key because it uses Go big.Int in non-constant-time operations (Cmp, modular exponentiation, modular inverse). The issue affects tss-lib versions prior to 2.0.0 and is noted for bnb-c...