Improper Verification of Cryptographic Signature Affecting sjcl package, versions *

sjcl is a Stanford Javascript Crypto Library

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH outputs. The dhJavaEc() function directly returns the raw x-coordinate of the scalar multiplication result (no hashing), providing a plaintext oracle without requiring any decryption feedback.

const sjcl = require('sjcl'); // with ECC loaded

const curve = sjcl.ecc.curves.k256;

// Point NOT on secp256k1 (y² ≠ x³ + 7)
const offCurve = new sjcl.ecc.point(curve, new sjcl.bn(5), new sjcl.bn(1));
console.log('isValid:', offCurve.isValid());  // false

// bitArray path: REJECTS (correct)
try {
  new sjcl.ecc.elGamal.publicKey(curve, offCurve.toBits());
  console.log('bitArray: accepted');
} catch (e) {
  console.log('bitArray: rejected ✓');
}

// point object path: ACCEPTS (bug)
try {
  new sjcl.ecc.elGamal.publicKey(curve, offCurve);
  console.log('pointObj: accepted ← BUG');
} catch (e) {
  console.log('pointObj: rejected');
}

• GitHub Commit
• GitHub Gist
• Vulnerable Code