Trust-Machines / wsts

Weighted Schnorr Threshold Signatures
Apache License 2.0
26 stars 12 forks source link

MI-08 Bad Randomness in Nonce Generation #80

Open xoloki opened 4 months ago

xoloki commented 4 months ago

There is an IETF standard for FROST which makes several relevant security suggestions. In particular to nonces, it hashes the random bytes to include an extra layer of security (here). However, in this library the nonce (e, d) is computed from two random bytestrings extracted from the EC wrapper (Scalar::random(rng) where rng represents OsRng) .