{"id":"GHSA-7j32-2mpw-c784","aliases":["RUSTSEC-2026-0240"],"status":"published","title":"Ed25519 identity public keys permit universal signature forgery","description":"All published versions of `dcrypt-sign` before 2.0.0 accepted the Edwards\nidentity as an Ed25519 public key. A signature with `R = B` and `S = 1` then\nverified for every message because the challenge term multiplied the identity.\nThe implementation also admitted other noncanonical or small-order inputs.\nConsumers that accepted externally supplied dcrypt Ed25519 keys may therefore\nhave accepted forged authorizations.\n\nVersion 2.0.0 replaces the custom arithmetic with `ed25519-dalek`, uses strict\nverification, and rejects noncanonical, small-order, and non-torsion-free public\nkeys and `R` values, as well as noncanonical `S \u003e= L`. No wrapper around the\naffected verifier is recommended as a complete workaround. Upgrade to 2.0.0 or\nlater, audit registered keys and trust stores, and review historical actions\nauthorized with externally supplied keys.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-09T12:00:00Z","modified":"2026-10-12T18:00:14Z","fixes":[{"ecosystem":"crates.io","package":"dcrypt-sign","fixed_in":["2.0.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"dcrypt-sign","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"2.0.0"}]}]}],"references":[{"url":"https://crates.io/crates/dcrypt-sign","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0240.html","tags":["advisory"]},{"url":"https://github.com/ioi-foundation/dcrypt/commit/c99cc86f0ee353010cd202cbcd2c310371b0bbb8","tags":["web"]},{"url":"https://github.com/ioi-foundation/dcrypt/releases/tag/v2.0.0","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0240","title":"Ed25519 identity public keys permit universal signature forgery","description":"All published versions of `dcrypt-sign` before 2.0.0 accepted the Edwards\nidentity as an Ed25519 public key. A signature with `R = B` and `S = 1` then\nverified for every message because the challenge term multiplied the identity.\nThe implementation also admitted other noncanonical or small-order inputs.\nConsumers that accepted externally supplied dcrypt Ed25519 keys may therefore\nhave accepted forged authorizations.\n\nVersion 2.0.0 replaces the custom arithmetic with `ed25519-dalek`, uses strict\nverification, and rejects noncanonical, small-order, and non-torsion-free public\nkeys and `R` values, as well as noncanonical `S \u003e= L`. No wrapper around the\naffected verifier is recommended as a complete workaround. Upgrade to 2.0.0 or\nlater, audit registered keys and trust stores, and review historical actions\nauthorized with externally supplied keys.","status":"published","published":"2026-08-09T12:00:00Z","modified":"2026-10-12T18:00:14.91083874Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}