CVE-2023-26557

Name of the Vulnerable Software and Affected Versions io.finnet tss-lib versions prior to 2.0.0 bnb-chain/tss-lib versions prior to 2.0.0 thorchain/tss versions prior to 2.0.0

Description The issue is related to a timing side-channel attack that can leak the lambda value of a private key. This occurs because the software relies on Go big.Int, which is not constant time for certain operations like Cmp, modular exponentiation, or modular inverse. An example of this leak can be found in crypto/paillier/paillier.go.

Recommendations For io.finnet tss-lib versions prior to 2.0.0, update to version 2.0.0 or later. For bnb-chain/tss-lib versions prior to 2.0.0, update to version 2.0.0 or later. For thorchain/tss versions prior to 2.0.0, update to version 2.0.0 or later.