dedis / cothority

Scalable collective authority
Other
426 stars 106 forks source link

Blocks created by `shuffle` and `decrypt` are signed with a useless signature #2510

Open ineiti opened 1 year ago

ineiti commented 1 year ago

The shuffle and decrypt protocols create a signature of the public key of the node who did the shuffle/decrypt and put this signature in the block. However, this signature is pretty useless, as it can easily be copied and re-used!

Fix: sign the actual data that is sent to the chain, if possible add the hash of the previous block to the data which is signed