search

miracle2k / ripple-python

Ripple-related routines in Python. Might become a proper client library later.
49 stars 31 forks source link

Does this software use deterministic nonces in its signatures? #7

Open Aquatrader opened 5 years ago

Aquatrader commented 5 years ago

Recently discovered security issue. See more here: https://ripple.com/dev-blog/statement-on-the-biased-nonce-sense-paper/

miracle2k commented 5 years ago

The ecdsa library used supports deterministic signatures (the ones suggested to be safe), but those are not used here. Instead, it seems the nonce is computed using randrange(). I opened a ticket with the library to ask for guidance:

https://github.com/warner/python-ecdsa/issues/103