Executive brief
Elliptic is a Node.js cryptography library used to perform ECDSA digital signature operations. A bug in its signature verification logic causes valid signatures to be incorrectly rejected when the message hash contains four or more leading zero bytes and certain curve properties are met. This can cause legitimate transactions or communications to be erroneously flagged as invalid, breaking system reliability.
Technical details
The vulnerability exists in the `_truncateToN` function in Elliptic prior to 6.6.0, which handles ECDSA signature verification. When the message digest is longer than the curve order, the function incorrectly truncates the hash by computing shift length based on the integer representation of the hash rather than the original digest byte length. If the digest starts with four or more leading zero bytes, this causes the function to truncate incorrectly, rejecting valid signatures that should verify successfully. The attack is triggered when processing any ECDSA signature where the hash digest size exceeds the curve order and contains leading zero bytes. The vulnerability is classified as an improper signature verification (CWE-347) and is fixed in version 6.6.0.
Affected products
- Elliptic Elliptic before 6.6.0
Timeline
- 2024-10-15: disclosed: Published to GitHub Advisory Database
- 2024-10-15: patched: Fixed in version 6.6.0