Skip to content

add missing validation to notary's secret in the Attestation #774

@themighty1

Description

@themighty1

Currently the prover is not performing validation in the Attestation of the Notary's secret used to derive the encodings.
Relevant code:

pub fn validate(&self, attestation: &Attestation) -> Result<(), InconsistentAttestation> {

This opens up an attack which will go like this:

  • the Notary flips an encoding of a single bit and sends the encodings to the Prover
  • the Prover commits (unknowingly) to the flipped encoding and gets an Attestation
  • later the Prover creates a presentation and sends it to an app-specific Verifier
  • the Verifier will fail or verify the encoding commitment
  • the Notary will observe the failure

at best, this would be a DoS attack against the Prover
additionally, the Notary will also learn whether a certain bit was opened to the Verifier or not

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions