Saint Zero, Who Signed Every Message

Patron of cryptographic libraries, digital signatures, and anyone who signs a blank cheque.

Life

On 9 November 2021 CVE-2021-43568 through CVE-2021-43572 were published: Stark Bank's ECDSA libraries for Python, Java, .NET, Node.js and Elixir did not check that the signature was non-zero. A signature made of nothing but zeros passed as valid for any message and any public key, so anyone could forge signatures at will. Paul Bottinelli of NCC Group found it, and fixes came in new releases, such as 2.0.1 for Python.

Prayer

O Saint Zero, who signs everything with nothing, remind us that even nothing must be verified. Amen.

How to celebrate

Celebrated by updating ECDSA libraries, rejecting signatures where r or s is zero, and preferring battle-tested cryptography to the home-made kind.