AIKIDO-2026-859106
sm-crypto is vulnerable to Signature Malleability
53
Medium Risk
This Affects:
sm-cryptoTL;DR
The SM2 DER signature decoder in sm-crypto reads the R and S integers by their own length bytes without requiring canonical, minimal encoding. decodeDer in the ASN.1 parser does not reject non-minimal INTEGERs, check the 02 tags, or compare the outer SEQUENCE length against the actual input, and doVerifySignature only range-checks the decoded values. Prepending 00 padding bytes to the R integer and adjusting the length bytes yields distinct signature strings that all verify against the same message and public key, so signatures are malleable. The fix enforces canonical DER on the verification path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application treats SM2 signature bytes as unique, for example for replay protection, deduplication, or idempotency tokens.
Background info
sm-crypto is vulnerable to Signature Malleability in versions 0.0.1 - 0.5.4.
How to fix this
Upgrade the sm-crypto library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant