Description
ECDSA side-channel attack named Minerava have been found and it was found that it affects to jsrsasign.
Execution time of thousands signature generation have been observed then EC private key which is scalar value may be recovered since point and scalar multiplication time depends on bits of scalar. In jsrsasign 8.0.
Recommendation
Update the jsrsasign package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.0.0, < 8.0.13
- Patched version(s): 8.0.13
References
Could your website be exposed too?
SmartScanner can check your website for ECDSA signature vulnerability of Minerva timing attack in jsrsasign and gives you actionable findings to investigate.
Start a free scanRelated Issues
- ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign - CVE-2020-14966
- cookie-signature Timing Attack - CVE-2016-1000236
- JWS and JWT signature validation vulnerability with special characters - CVE-2022-25898
- RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign - CVE-2020-14968
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023