Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2025-66017

CGGMP21 presignatures can be used in the way that significantly reduces security

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. In versions 0.6.3 and prior of cggmp21 and version 0.7.0-alpha.1 of cggmp24, presignatures can be used in the way that significantly reduces security. cggmp24 version 0.7.0-alpha.2 release contains API changes that make it impossible to use presignatures in contexts in which it reduces security.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

LFDT-Lockness cggmp21

  • cggmp21 <= 0.6.3affected
  • cggmp24 = 0.7.0-alpha.1affected

References