The Frozen Heart vulnerability in Girault’s proof of knowledge
Summary: Trail of Bits detailed how a Frozen Heart vulnerability in ZenGo's implementation of Girault's proof of knowledge, before it was patched, let a malicious prover forge proofs for random h values because the Fiat-Shamir hash covered g, N, and u but omitted h. The attack picks random u and z, computes e = Hash(g,N,u), then solves for an h that passes the verification check u = g^z h^e mod N, which requires knowing phi(N) and thus the prime factors of N.
Why it matters: The flaw is only as dangerous as its deployment: for standalone public keys it is no stronger than picking a random x, but inside a larger protocol such as a threshold signature scheme that requires unforgeable proofs, a forged proof is likely very severe.
Read the original at Trail of Bits Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026