Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

keybase/go-crypto

              master @ de78d2c
            

Fixes

CVEs

HIGH

Peak severity

33.3%

Coverage

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

openpgp: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Critical logical flaws in the main signature verification pipeline and error-handling paths allowed invalid signatures to bypass verification or let revoked subkeys be trusted. Tight validation on cryptographic states is essential.

Auth Bypass: Silently ignoring internal hashing/signing errors or failing to validate flag configurations can result in the generation or acceptance of invalid and zero-flag signatures.

Signature Malleability: Missing bounds checks on signature scalars allowed non-canonical Ed25519 signatures to be verified, which can facilitate signature-malleability-based replay or validation attacks.