Executive brief
@nfid/embed is a JavaScript SDK for building applications on the Internet Computer blockchain. Due to insecure session key generation in an underlying authentication library, users' private keys were compromised, exposing them to theft of cryptocurrency funds and unauthorized access to blockchain assets under their control. An attacker could exploit the publicly disclosed weak key material to gain full control of affected user accounts.
Technical details
The vulnerability exists in the Ed25519KeyIdentity.generate function within @dfinity/auth-client and @dfinity/identity libraries. The function accepts an optional seed parameter for key generation, but when no seed is provided, it should generate a cryptographically secure random seed; however, a recent code change broke this guarantee by using an insecure seed instead. This results in predictable, non-random Ed25519 private keys. An attacker with knowledge of the compromised key generation logic can derive session keys and gain unauthorized access to user accounts and assets. The vulnerability affects @nfid/embed versions 0.10.0 through 0.10.1-alpha.5, and is patched in @dfinity/auth-client and @dfinity/identity version 1.0.1 or later. No authentication or user interaction is required to exploit this; the weakness is baked into the cryptographic material itself during the SDK's key generation phase.
Affected products
- DFINITY auth-client >=0.20.0-beta.0, <1.0.1
- DFINITY identity >=0.20.0-beta.0, <1.0.1
- Internet Identity Labs @nfid/embed >=0.10.0, <0.10.1-alpha.6
Timeline
- 2024-02-21: disclosed: DFINITY agent-js advisory GHSA-c9vv-fhgv-cjc3 published
- 2024-02-26: disclosed: @nfid/embed advisory GHSA-84c3-j8r2-mcm8 published
- 2024-02-21: patched: @dfinity/auth-client and @dfinity/identity patched in version 1.0.1
- 2024-02-26: patched: @nfid/embed patched in version 0.10.1-alpha.6