Trust-Machines / wsts

Weighted Schnorr Threshold Signatures
Apache License 2.0
26 stars 12 forks source link

CR-01 Missing Inbound Messages Authentication #66

Open xoloki opened 4 months ago

xoloki commented 4 months ago

The methods process_inbound_messages() used by signer and coordinator do not authenticate the data received. So while signers and the coordinator sign the messages they send, the signature is not checked (neither by signers nor coordinator) within the library and the responsibility is left for the implementers.