Insecure Key Pair Generation in Ed25519KeyIdentity Could Lead to Loss of Funds or Access

CVE-2024-1631

Summary

The DFINITY Identity Library has a vulnerability in its key pair generation function, specifically within Ed25519KeyIdentity.generate. Though it is designed to generate a secure secret key from an optional 32-byte seed, a recent update has compromised this functionality. Instead of using secure random values, the library may utilize a non-secure seed for generating keys. This flaw jeopardizes the integrity of the private keys, leading to possible unauthorized access to funds or canisters where the compromised key is a controlling principal. Users relying on this library are at significant risk if the seed value is not securely managed.

References