Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Affecting @dfinity/identity package, versions >=0.20.0-beta.0 <1.0.1


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.05% (17th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-DFINITYIDENTITY-6262150
  • published 22 Feb 2024
  • disclosed 21 Feb 2024
  • credit David Dal Busco

How to fix?

Upgrade @dfinity/identity to version 1.0.1 or higher.

Overview

@dfinity/identity is a JavaScript and TypeScript library to manage identity with the Internet Computer

Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) due to the use of an insecure seed for key pair generation in the Ed25519KeyIdentity.generate function. An attacker can compromise the private key of an identity, potentially leading to loss of funds associated with the principal on ledgers or loss of access to a canister where this principal is the controller.

Note:

This is only exploitable if the optional parameter to provide a 32 byte seed value is not used, leading to the generation of a key pair with an insecure seed.

Workaround

This vulnerability can be mitigated by invoking the function as Ed25519KeyIdentity.generate(null) to fix the broken conditional evaluation and force the function to generate a securely random seed, or by passing a securely generated randomness as a seed to Ed25519KeyIdentity.generate to force the library to use it as the seed for key pair generation.

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
9.1 critical
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    None