Repository navigation
Conversation
Ranjna-G
force-pushed
the
CSHLD-2073-crypto-bigint-ignore-reason
branch
from
October 28, 2026 05:39
38b2546 to
57deed5
Compare
The recorded rationale was wrong: k256's Scalar add/sub/neg do reach crypto-bigint add_mod/sub_mod/neg_mod during MuSig2 partial signing, so the "not exposed to attacker-controlled input" argument does not hold. The correct rationale is target-based: wasm-utxo executes under a JS JIT, which gives no constant-time guarantees regardless of the crypto-bigint version, so the patched >=0.7.6 changes nothing here. Keep the delete-when-k256-moves-to-elliptic-curve-0.14+ exit condition. Security-team approval requested on the PR. Ticket: CSHLD-2073
Ranjna-G
force-pushed
the
CSHLD-2073-crypto-bigint-ignore-reason
branch
from
October 28, 2026 05:46
57deed5 to
0baa2da
Compare
Ranjna-G
marked this pull request as ready for review
October 28, 2026 06:03
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
Ranjna-G
enabled auto-merge
October 28, 2026 06:03
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #448 per review feedback (r4393606887): corrects the recorded rationale for the
RUSTSEC-2026-0387(crypto-bigint constant-time) advisory ignore. The old reason claimed k256's usage "does not expose the affected operations to attacker-controlled input" — that is wrong: k256's Scalaradd/sub/neggo through crypto-bigintadd_mod/sub_mod/neg_modduring MuSig2 partial signing, so the vulnerable code is exercised.The correct rationale is target-based: wasm-utxo executes under a JS JIT, which gives no constant-time guarantees regardless of the crypto-bigint version — so the patched
>=0.7.6changes nothing for this target.Exit condition (checked 2026-10-28): k256
0.14.0is released and its elliptic-curve 0.14 line drops crypto-bigint entirely, but wasm-utxo reaches k256 only throughmusig2, whose latest release (0.4.1) still pinsk256 ^0.13with no 0.14 work in its repo. The ignore is deleted once musig2 moves to k256 0.14+ (cargo-deny warns on unmatched ignores once it applies).Linear: CSHLD-2073
Security-team approval
@BitGo/security — per the review request on #448, this advisory-ignore rationale needs security-team sign-off. The claim to validate: ignoring RUSTSEC-2026-0387 (crypto-bigint constant-time issues) is acceptable for wasm-utxo because the wasm-under-JS-JIT execution environment provides no constant-time guarantees independent of the crypto-bigint version.
Changes
packages/wasm-utxo/deny.toml— correctedRUSTSEC-2026-0387ignore reason and the explanatory comment: vulnerable ops ARE reached via k256 MuSig2 partial signing; constant-time concern is moot under a JS JIT.Test Plan
tomllibparse ofdeny.toml— OK.cargo deny check advisoriesunchanged in behavior (same ignore id, only the reason string differs).