search

jatchili / minimalist-ripple-client

minimalist ripple client
https://jatchili.github.io/minimalist-ripple-client/
GNU General Public License v2.0
143 stars 54 forks source link

[Security] ripple-lib used by the client is vulnerable to ECDSA attacks #24

Open LouSparfell opened 5 years ago

LouSparfell commented 5 years ago

Signing software contained in ripple-lib packages published by Ripple before August 2015 use insufficiently random “nonces” and are vulnerable to "ECDSA attacks".

https://ripple.com/dev-blog/statement-on-the-biased-nonce-sense-paper/

Is it possible to upgrade the ripple-lib ?