You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If I don't misremember eos public keys are always compressed so would be hard for an attacker to craft a malicious public key. Wouldn't hurt to validate the point in the shared secret method though, if the elliptic library doesn't do it already.
secp256k1 keys may not be suitable for EDCH
I found out about this issue when looking into using a secp256k1 key using the well supported did-jwt library, where I found this note: https://github.com/decentralized-identity/veramo/blob/0c22cc6a79e974214500e4440b0ea2977012377d/packages/utils/src/did-utils.ts#L269
I then followed up and found secp256k1 keys are not supported due to Twist attacks. See here
This issue is prevalent during the EDCH code found in
https://github.com/wharfkit/antelope/blob/master/src/crypto/shared-secret.ts
The text was updated successfully, but these errors were encountered: