Go/github.com/taurusgroup/multi-party-sig: high

Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws

Action: Upgrade github.com/taurusgroup/multi-party-sig to 0.7.0-alpha-2025-01-28 or later.

go get github.com/taurusgroup/multi-party-sig@v0.7.0-alpha-2025-01-28

Affected

Fixed versions

Sources

• osv: GHSA-7f6p-phw2-8253
• https://github.com/taurushq-io/multi-party-sig/security/advisories/GHSA-7f6p-phw2-8253
• https://eprint.iacr.org/2018/499.pdf
• https://github.com/taurushq-io/multi-party-sig
• https://github.com/taurushq-io/multi-party-sig/blob/4d84aafb57b437da1b933db9a265fb7ce4e7c138/internal/ot/extended.go#L188
• https://github.com/taurushq-io/multi-party-sig/blob/9e4400fccee89be6195d0a12dd0ed052288d5040/internal/ot/extended.go#L114
• https://github.com/taurushq-io/multi-party-sig/tree/otfix

published 2024-11-25T15:11:11Z · modified 2025-01-28T18:06:15Z · JSON