HSEC-2025-0002
Double Public Key Signing Function Oracle Attack on Ed25519
Published Nov 14, 2025 · updated Apr 18, 2026
# Double Public Key Signing Function Oracle Attack on Ed25519 The standard specification of Ed25519 message signing involves providing the algorithm with a message and private key. The function will use the private key to compute the public key and sign the message. Some libraries provide a variant of the message signing function that also takes the pre-computed public key as an input parameter. Libraries that allow arbitrary public keys as inputs without checking if the input public key corresponds to the input private key are vulnerable to the following attack. By using several public keys and messages, a malicious user with access to the signing mechanism may build up insights into the private key parameters resulting in access to the private key. This shortcoming means that an attacker could use the signing function as an Oracle, perform crypto-analysis and ultimately get at secrets. For example, an attacker who can’t access the private key but can access the signing mechanism through an API call could use several public keys and messages to gradually build up insights into private key parameters.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Nov 14, 2025 · OSV.dev
Detected
# Double Public Key Signing Function Oracle Attack on Ed25519 The standard specification of Ed25519 message signing involves providing the algorithm with a message and private key. The function will use the private key to compute the public key and sign the message. Some libraries provide a variant of the message signing function that also takes the pre-computed public key as an input parameter. L
Apr 18, 2026 · OSV.dev
Fix available
crypton fixed in 1.0.3
Apr 18, 2026 · OSV.dev
Fix available
crypton fixed in 1.0.3
Apr 18, 2026 · OSV.dev
Updated
# Double Public Key Signing Function Oracle Attack on Ed25519 The standard specification of Ed25519 message signing involves providing the algorithm with a message and private key. The function will use the private key to compute the public key and sign the message. Some libraries provide a variant of the message signing function that also takes the pre-computed public key as an input parameter. L
Affected
- Hackage crypton0.31 → 1.0.3
- Hackage cryptonite0.1, 0.10, 0.11