CVE-2023-33241
Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.18%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signatures or more fully exfiltrate the other parties' private key shares.
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 1.18% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74
- Affected
- gg18 project/gg18 · gg20 project/gg20
- Source
- disclosures@halborn.com
References
- https://eprint.iacr.org/2019/114.pdfExploit, Third Party Advisory
- https://eprint.iacr.org/2020/540.pdfExploit, Third Party Advisory
- https://github.com/fireblocks-labs/mpc-ecdsa-attacks-23Exploit
- https://github.com/fireblocks-labs/safeheron-gg20-exploit-pocExploit
- https://www.fireblocks.com/blog/gg18-and-gg20-paillier-key-vulnerability-technical-report/Third Party Advisory
- https://eprint.iacr.org/2019/114.pdfExploit, Third Party Advisory
- https://eprint.iacr.org/2020/540.pdfExploit, Third Party Advisory
- https://github.com/fireblocks-labs/mpc-ecdsa-attacks-23Exploit
- https://github.com/fireblocks-labs/safeheron-gg20-exploit-pocExploit
- https://www.fireblocks.com/blog/gg18-and-gg20-paillier-key-vulnerability-technical-report/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.