Vulnerability Description
The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values from the Zero Knowledge proof statement as well as all of the public values computed in the proof, aka the Frozen Heart issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bulletproofs Project | Bulletproofs | - |
Related Weaknesses (CWE)
References
- https://blog.trailofbits.com/2022/04/13/part-1-coordinated-disclosure-of-vulneraExploitThird Party Advisory
- https://eprint.iacr.org/2017/1066ProductTechnical DescriptionThird Party Advisory
- https://blog.trailofbits.com/2022/04/13/part-1-coordinated-disclosure-of-vulneraExploitThird Party Advisory
- https://eprint.iacr.org/2017/1066ProductTechnical DescriptionThird Party Advisory
FAQ
What is CVE-2022-29566?
CVE-2022-29566 is a vulnerability with a CVSS score of 8.1 (HIGH). The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values from the Zero Knowledge proof statement as well as all of the ...
How severe is CVE-2022-29566?
CVE-2022-29566 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-29566?
Check the references section above for vendor advisories and patch information. Affected products include: Bulletproofs Project Bulletproofs.