| शीर्षक | GitHub Dropbear 2025.89 Improper Verification of Cryptographic Signature |
|---|
| विवरण | The specific issue is located in curve25519.c:
Line 484 directly uses s+32 for computation, with no validation for S >= L at any point.
According to the RFC 8032 §5.1.7 specification, an out-of-bounds S should be rejected. Without this check, we can generate an equivalent signature by constructing S' = S + L. My local testing confirms that Dropbear's verification process accepts both the original signature and its S+L variant. Furthermore, the paper "The Provable Security of Ed25519: Theory and Practice" by Jacqueline Brendel, Cas Cremers, Dennis Jackson, and Mang Zhao (https://ieeexplore.ieee.org/stampPDF/getPDF.jsp?arnumber=9519456) emphasizes that strictly rejecting such non-canonical signatures is necessary to maintain Strong Existential Unforgeability under Chosen Message Attacks (SUF-CMA).
Historically, there have been multiple signature malleability vulnerabilities in other projects (e.g., CVE-2020-36843, CVE-2024-45193). This inconsistency with the specification breaks signature uniqueness and could potentially impact higher-level security policies or auditing logic that rely on it. |
|---|
| स्रोत | ⚠️ https://github.com/mkj/dropbear/issues/406 |
|---|
| उपयोगकर्ता | pythok (UID 95793) |
|---|
| सबमिशन | 23/02/2026 05:02 PM (7 महीनों पहले) |
|---|
| संयम | 07/03/2026 10:07 AM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 349652 [mkj Dropbear तक 2025.89 S Range Check src/curve25519.c unpackneg कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|