CyberRota Analysis
AI-GeneratedThe mirage-crypto-ec function in versions prior to 2.2.0 for OCaml is vulnerable, allowing the ECDSA functions to accept the point at infinity (0x00) as a valid public key. This flaw enables attackers to forge signatures without possessing the corresponding private key, potentially compromising the integrity of cryptographic operations. Developers and organizations utilizing this library should prioritize patching to mitigate the risk of unauthorized signature generation.
Original NVD Description
An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.