avalanchego
avalanchego copied to clipboard
Update blst to 0.3.12
Context and scope
Currently avalanchego uses the version 0.3.11 of the library blst to implement the cryptographic signature BLS12-381. The version 0.3.12 of blst improves security as described in its release notes https://github.com/supranational/blst/releases/tag/v0.3.12 and in particular includes the commits https://github.com/supranational/blst/commit/dae1f9416f157112be1dc46209a32ed5414fd525 and https://github.com/supranational/blst/commit/6cca12ac0c10ca8752d1788ee44891261c0f272a that
- Improve security of the library by moving constants to a read-only section (not allowing attackers to modify the constants after the program starts)
- Works with OpenBSD/adJ and advances #2782. Due to security policies of that OS the previous version 0.3.11 with avalanchego produced segmentation faults sporadically, see https://github.com/supranational/blst/issues/206 The issue was solved with the mentioned commits included in version 0.3.12.
Discussion and alternatives IMHO it is a good security practice to update version of libraries periodically.
Open questions
This issue has become stale because it has been open 60 days with no activity. Adding the lifecycle/frozen label will cause this issue to ignore lifecycle events.
I have been updating the corresponding PR #3080
Closing because it was updated in go.mod