Junglewise Threat Intelligence

CVE-2024-48930: secp256k1-node private key extraction in ECDH

CVE-2024-48930 · Severity: medium · CVSS 4 · Published 2024-10-21

Executive brief

secp256k1-node is a JavaScript library that provides elliptic curve cryptography operations for the secp256k1 curve, widely used in blockchain and cryptocurrency applications. An attacker can extract a private key by conducting as few as 11 ECDH sessions using specially crafted public keys that bypass validation checks. The attack requires minimal computational effort (a few days to precompute, then ~10 minutes to extract) and does not require access to the actual ECDH output—only the ability to confirm results offline.

Technical details

The vulnerability exists in the elliptic-based implementation of secp256k1-node. The loadCompressedPublicKey function lacks validation to verify that a decompressed public key lies on the secp256k1 curve (Y² = X³ + 7). When an attacker provides a compressed key (X coordinate) for which no valid Y value exists on the curve, the code computes Y for a different curve equation (Y² = X³ + D, where D ≠ 7). If this alternate curve has low cardinality, the resulting point becomes a low-order element, causing ECDH outputs to repeat in a predictable, brute-forceable set. By using 10–11 carefully crafted public keys, an attacker can extract 238.4 bits of a 256-bit private key through repeated ECDH sessions; the remaining bits are trivially brute-forced. The attacker needs only to confirm ECDH results offline (e.g., by testing decryption) and does not require direct access to output values. Additionally, publicKeyVerify() incorrectly returns true for these invalid keys. Patches are available in versions 5.0.1, 4.0.4, and 3.8.1.

Affected products

  • cryptocoinjs secp256k1 <=5.0.0, <=4.0.3, <=4.0.2, <=4.0.1, <=4.0.0, <=3.8.0

Timeline

  • 2024-10-21: disclosed: Advisory GHSA-584q-6j8j-r5pm published; CVE-2024-48930 assigned

References