FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

nettle 3.7.2 -- fix serious ECDSA signature verify bug

Affected packages
nettle < 3.7.2
linux-c7-nettle < 3.7.2


VuXML ID 80f9dbd3-8eec-11eb-b9e8-3525f51429a0
Discovery 2021-03-21
Entry 2021-03-27

Niels Möller reports:

I've prepared a new bug-fix release of Nettle, a low-level cryptographics library, to fix a serious bug in the function to verify ECDSA signatures. Implications include an assertion failure, which could be used for denial-of-service, when verifying signatures on the secp_224r1 and secp521_r1 curves.

Even when no assert is triggered in ecdsa_verify, ECC point multiplication may get invalid intermediate values as input, and produce incorrect results. [...] It appears difficult to construct an alleged signature that makes the function misbehave in such a way that an invalid signature is accepted as valid, but such attacks can't be ruled out without further analysis.