Executive brief
jsrsasign is a popular JavaScript library used for digital signatures and encryption. A flaw in its digital signature process allows an attacker to potentially recover a server's private key if an invalid signature is generated. If a private key is stolen, an attacker could impersonate the service, decrypt sensitive data, or forge official communications.
Technical details
The vulnerability exists in the `KJUR.crypto.DSA.signWithMessageHash` function. The implementation fails to comply with FIPS 186-4 §4.6, which requires that if the DSA signature components 'r' or 's' are zero, the signer must select a new ephemeral key 'k' and retry the process. Because jsrsasign emits these invalid signatures without retrying, an attacker observing a signature where s=0 can solve for the private key 'x' using the formula x = -H(m) * r^-1 mod q. While the natural probability of this occurring is low (~1/q), the impact is a total compromise of the private key. This is addressed in version 11.1.1 by adding a retry loop.
Affected products
- kjur jsrsasign < 11.1.1
Timeline
- 2026-02-16: disclosed: Vulnerability reported by Kr0emer
- 2026-02-20: patched: Fix merged into master branch
- 2026-03-23: advisory: CVE-2026-4601 published