{"id":"HSEC-2025-0002","summary":"Double Public Key Signing Function Oracle Attack on Ed25519","details":"# Double Public Key Signing Function Oracle Attack on Ed25519\n\nThe standard specification of Ed25519 message signing involves providing the\nalgorithm with a message and private key.\n\nThe function will use the private key to compute the public key and sign the message.\nSome libraries provide a variant of the message signing function that also takes\nthe pre-computed public key as an input parameter.\n\nLibraries that allow arbitrary public keys as inputs without checking if the\ninput public key corresponds to the input private key are vulnerable to the\nfollowing attack.\n\nBy using several public keys and messages, a malicious user with access to the\nsigning mechanism may build up insights into the private key parameters\nresulting in access to the private key.\n\nThis shortcoming means that an attacker could use the signing function as an\nOracle, perform crypto-analysis and ultimately get at secrets.\nFor example, an attacker who can’t access the private key but can access\nthe signing mechanism through an API call could use several public keys and\nmessages to gradually build up insights into private key parameters.\n","modified":"2026-04-18T18:31:14.236075Z","published":"2025-11-14T14:45:34Z","related":["GHSA-w5vr-6qhr-36cc"],"database_specific":{"home":"https://github.com/haskell/security-advisories","osvs":"https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export","repository":"https://github.com/haskell/security-advisories"},"references":[{"type":"ARTICLE","url":"https://web.archive.org/web/20250917120037/https://portswigger.net/daily-swig/dozens-of-cryptography-libraries-vulnerable-to-private-key-theft"},{"type":"ARTICLE","url":"https://github.com/MystenLabs/ed25519-unsafe-libs"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w5vr-6qhr-36cc"},{"type":"EVIDENCE","url":"https://hackage.haskell.org/package/cryptonite-0.30/docs/src/Crypto.PubKey.Ed25519.html#sign"},{"type":"EVIDENCE","url":"https://github.com/haskell-crypto/cryptonite/blob/cryptonite-v0.30/cbits/ed25519/ed25519.c#53"},{"type":"EVIDENCE","url":"https://github.com/kazu-yamamoto/crypton/blob/48fb9df2de5ee752196724b081f4d3cdb57576ed/cbits/ed25519/ed25519.c#L53"},{"type":"FIX","url":"https://github.com/kazu-yamamoto/crypton/pull/47"}],"affected":[{"package":{"name":"cryptonite","ecosystem":"Hackage","purl":"pkg:hackage/cryptonite"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1"}]}],"versions":["0.1","0.10","0.11","0.12","0.13","0.14","0.15","0.15.1","0.16","0.17","0.18","0.19","0.2","0.20","0.21","0.22","0.23","0.24","0.25","0.26","0.27","0.28","0.29","0.3","0.30","0.4","0.5","0.6","0.7","0.8","0.9"],"database_specific":{"human_link":"https://github.com/haskell/security-advisories/tree/main/advisories/published/2025/HSEC-2025-0002.md","osv":"https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2025/HSEC-2025-0002.json","source":"https://github.com/haskell/security-advisories/blob/generated/osv-export/2025/HSEC-2025-0002.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"}]},{"package":{"name":"crypton","ecosystem":"Hackage","purl":"pkg:hackage/crypton"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.31"},{"fixed":"1.0.3"}]}],"versions":["0.31","0.32","0.33","0.34","1.0.0","1.0.1","1.0.2"],"database_specific":{"osv":"https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2025/HSEC-2025-0002.json","source":"https://github.com/haskell/security-advisories/blob/generated/osv-export/2025/HSEC-2025-0002.json","human_link":"https://github.com/haskell/security-advisories/tree/main/advisories/published/2025/HSEC-2025-0002.md"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"}]}],"schema_version":"1.7.5"}