Executive brief
Elliptic is a JavaScript library used for cryptographic elliptic-curve operations in web and Node.js applications. A flaw in its ECDSA signature generation can produce incorrect signatures and allow private key exposure under certain conditions, breaking legitimate transactions and potentially compromising cryptographic security.
Technical details
The vulnerability exists in the ECDSA implementation's handling of the nonce value 'k' as specified in RFC 6979. When k has leading zeros, the byte-length is incorrectly computed, causing k to be truncated during signature generation. This produces invalid signatures that fail verification in compliant implementations. More critically, if an attacker obtains both a faulty signature from the vulnerable Elliptic version and a correct signature for identical inputs, they can derive the private key through cryptanalysis. The root cause is in the truncateToN function in ec/index.js, which incorrectly uses the integer representation's byte length rather than the message digest's actual length. All versions up to and including 6.6.1 are affected. Attack requires either chosen-message capability or prehashed inputs without proof of origin.
Affected products
- indutny elliptic All versions up to and including 6.6.1
Timeline
- 2024-10-13: disclosed: GitHub issue #321 filed by security researcher
- 2026-01-08: advisory: GHSA-848j-6mx2-7j84 and CVE-2025-14505 published