Verify Signatures are in the correct Sub-group

Open kirk-baird opened this issue 6 years ago • 3 comments

py-ecc Version: 1.7.1

What is wrong?

Currently verification of a signature does not check that the signature is in the correct subgroup. This poses a security risk when verifying a pairing.

How can it be fixed

When verifying a signature check r * sig == 0 before pairing.

I will update #79 to include the check as this had been inserted into the standard.

Oct 17 '19 03:10 kirk-baird

If this isn't explicitely part of #79 maybe this change can be extracted to a stand-alone PR?

Oct 18 '19 17:10 pipermerriam

I made this PR cause it is a security vulnerability that currently exists but it is included as part or the BLS stand.

Do you this it should be it's own PR or part of the BLS standard PR?

Oct 19 '19 13:10 kirk-baird

I've added this in #79

Oct 21 '19 05:10 kirk-baird