Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
tss-lib 安全漏洞
Vulnerability Description
tss-lib是IO FinNet开源的一个基于 Gennaro 和 Goldfeder 2020[1] 和 EdDSA (Edwards Curve Digital Signature Algorithm) 的多方 {t,n}- 阈值 ECDSA（椭圆曲线数字签名算法）的实现。 IO FinNet tss-lib 2.0.0 之前版本存在安全漏洞，该漏洞源于MPC 实现不使用用于定义会话 ID 的参数 ssid，这使得消息的重放和欺骗更加容易，除此之外，在 sch.go 中实现的 Schnorr imp
CVSS Information
N/A
Vulnerability Type
N/A