Unlinkability broken in ursa when verifiers use malicious keys

CVE-2022-31021

What is CVE-2022-31021?

The vulnerability in Hyperledger's Ursa cryptographic library stems from a fundamental weakness in the AnonCreds specification, where the Issuer fails to publish a key correctness proof that verifies the ability of a generated private key to uphold the unlinkability guarantees integral to AnonCreds. While the Ursa and AnonCreds implementations generate private keys that should be adequate, there exists a potential threat from a malicious issuer who could develop a custom CL Signature implementation using weakened private keys. This could allow them to link presentations from credential holders back to the issuer, undermining the privacy intended by the AnonCreds framework. As the Ursa project is now at end-of-life status, no resolutions for this vulnerability are anticipated, leaving users of AnonCreds credentials susceptible to privacy risks.

References