What we learned reviewing one of the first DKLs23 libraries from Silence Laboratories

Summary: Trail of Bits audited Silence Laboratories' Silent Shard library, one of the first production implementations of the DKLs23 threshold signature scheme, in October 2023 and identified 15 security issues, including two high-severity flaws that could have enabled key destruction and potentially key recovery attacks. The two high-severity findings were TOB-SILA-6, where communication channels between parties could reuse nonces, and TOB-SILA-12, where mishandled selective abort attacks caused a panic that prevented parties from identifying the malicious party.
Bottom line: A nonce reuse flaw in the pairwise channels of a threshold signing library lets a single malicious party block signing entirely, and a broken identifiable abort forces the remaining parties to either blame everyone or blame no one, each path leading to key destruction or key extraction. Silence Laboratories has since resolved 14 of the 15 issues and partially resolved the remaining informational one.

Read the original at Trail of Bits Blog ↗