Executive brief
The sm-crypto library, used for SM2 encryption and digital signatures, contains a flaw in how it generates secret keys when running in Node.js environments. Instead of using a secure random number generator, it uses predictable data like the system clock and standard math functions. This allows an attacker to predict private keys and forge digital signatures, potentially leading to complete compromise of encrypted communications or authenticated identities.
Technical details
The sm-crypto library (specifically version 0.4.0 and earlier) relies on the jsbn library's SecureRandom PRNG. In Node.js environments, jsbn fails to detect a cryptographically secure PRNG because it checks for 'window.crypto' instead of 'globalThis.crypto'. Consequently, it falls back to seeding an ARC4 stream using 'Math.random()' (V8's xorshift128+) and 'Date.getTime()'. Because these sources are predictable or estimable, an attacker can reconstruct the RNG state to recover SM2 private keys or predict the ephemeral scalar 'k' used during signing. Predicting 'k' in SM2 (an EC-Schnorr-like scheme) allows for immediate recovery of the private key from a single signature. The issue is addressed in version 0.5.0.
Affected products
- JuneAndGreen sm-crypto < 0.5.0
Timeline
- 2026-01-20: other: Vulnerable version 0.4.0 published
- 2026-07-23: advisory: GitHub Advisory GHSA-vh45-f885-3848 published
- 2026-07-24: patched: Vulnerability reported as patched in version 0.5.0