Message from Zenith:

Target

groth16.rs

Severity:

Impact: High
Likelihood: High

Description:

When performing decompression, there are not validations on whether the resulting point is in the correct prime-order subgroup.
In the case of decompress_g1_from_compressed, since Fq::sqrt_montgomery does not verify whether a point is a quadratic residue, the result can be an invalid point of the curve. As for decompress_g2_from_compressed, the resulting point can be on the curve but not in the correct prime-order subgroup. Thus explicit subgroup check is necessary for G2 points.
Using points not in the correct prime-order subgroup may break the paring computation and allow attackers to forge a Groth16 proof.

Recommendations:

For G1 decompression, verify the result of Fq::sqrt_montgomery to make sure it is a valid elliptic curve point.
For G2 decompression, add explicit subgroup check for the resulting point. A simple way of subgroup check for point P is to see if [r]P = O, where r is the order of G2 and O is the identity. A more efficient way can be found in [Section 4.3, HGP].

Client:

Zenith:

audit: add G2 subgroup check #5

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions