Published: 2025-11-25T20:16:00.640
Overview
A significant security vulnerability, identified as CVE-2025-66016, has been discovered in CGGMP24, a state-of-the-art ECDSA Threshold Signature Scheme (TSS) protocol. This protocol supports 1-round signing (requiring 3 preprocessing rounds), identifiable abort, and a key refresh protocol. The vulnerability, present in versions prior to 0.6.3, allows a single malicious signer to potentially reconstruct the full private key due to a missing check in the Zero-Knowledge (ZK) proof.
Technical Details
The core issue lies in an insufficient validation within the ZK proof mechanism of the CGGMP24 protocol. Without proper verification, a malicious actor participating in the signing process can leverage this flaw to extract sensitive information about the underlying private key. This bypasses the intended security guarantees of the TSS protocol, which aims to distribute trust and prevent single points of failure.
The vulnerable versions include all versions before 0.6.3. The fix implemented in version 0.6.3 addresses the missing ZK proof check. However, for more comprehensive security checks and enhanced defenses, upgrading to version 0.7.0-alpha.2 is strongly recommended.
CVSS Analysis
Currently, a CVSS score is not available for CVE-2025-66016. However, given the potential for complete private key reconstruction by a single malicious party, the severity is likely to be considered high to critical. We strongly advise organizations using CGGMP24 to prioritize patching this vulnerability. A full CVSS score calculation will be provided once available.
Possible Impact
The compromise of the private key due to CVE-2025-66016 could have severe consequences, including:
- Unauthorized Transactions: Malicious actors could use the reconstructed private key to sign unauthorized transactions, leading to financial losses or data breaches.
- Reputational Damage: Organizations relying on CGGMP24 for security could suffer significant reputational damage if the private key is compromised.
- Data Loss: The compromise of cryptographic keys can lead to the loss of access to encrypted data and systems.
Mitigation and Patch Steps
To mitigate the risk posed by CVE-2025-66016, the following steps are recommended:
- Upgrade Immediately: Upgrade to CGGMP24 version 0.6.3 as a minimum. However, for the most robust security checks, upgrading to version 0.7.0-alpha.2 is highly recommended.
- Review Security Practices: Audit your current implementation of CGGMP24 and related security practices to identify any potential weaknesses.
- Monitor for Suspicious Activity: Continuously monitor your systems for any unusual or suspicious activity that might indicate a compromise.
