--- title: "Devious Transfer: Breaking Oblivious Transfer-based Threshold ECDSA" description: Our cryptography team has recently uncovered three critical vulnerabilities in open-source cryptographic libraries. image: https://blog.fordefi.com/hubfs/Aviv%20Frenkel%20%26%20Dima%20Kogan.png --- [Skip to Content](https://blog.fordefi.com/devious-transfer-breaking-oblivious-transfer-based-threshold-ecdsa#body) [![Fordefi logo- horizontal - color + dark](https://blog.fordefi.com/hs-fs/hubfs/Fordefi%20logo-%20horizontal%20-%20color%20+%20dark.png?width=154&height=25&name=Fordefi%20logo-%20horizontal%20-%20color%20+%20dark.png "Fordefi logo- horizontal - color + dark")](http://fordefi.com) Toggle Menu - [Product](https://fordefi.com/) - [Company](https://fordefi.com/company) # Devious Transfer: Breaking Oblivious Transfer-based Threshold ECDSA Read Time **3 mins** | Written by: Aviv Frenkel ![](https://blog.fordefi.com/hubfs/Aviv%20Frenkel%20%26%20Dima%20Kogan.png) ```   ``` *This research and blog post has been co-authored by Aviv Frenkel, Dima Kogan, and Ben Riva (Mysten Labs).* --- Our cryptography team has recently uncovered three critical vulnerabilities in open-source cryptographic libraries. Two of these vulnerabilities result in key extraction attacks on Threshold ECDSA implementations within these libraries. The vulnerabilities were found in implementations of Oblivious Transfer, a simple yet fundamental cryptographic building block for Multi-Party Computation (MPC) protocols. Threshold signature schemes (TSS) are a key component of MPC wallets, enabling multiple parties to collaboratively generate digital signatures without revealing their key shares. There are two main approaches to constructing threshold signatures for the ECDSA signature scheme: 1. Linearly Homomorphic Encryption (LHE) 2. Oblivious Transfer (OT) While LHE-based TSS schemes have faced significant attacks recently with [BitForge](https://eprint.iacr.org/2023/1234) and [TSSHOCK](https://i.blackhat.com/BH-US-23/Presentations/US-23-Nguyen-TSSHOCK-Breaking-MPC-Wallets-wp.pdf), OT-based protocols have gained popularity due to their simplicity and perceived robustness. ![devious transfer](https://blog.fordefi.com/hs-fs/hubfs/devious%20transfer.png?width=2000&height=761&name=devious%20transfer.png) Our research suggests that although OT-based TSS implementations show promise, security can still be improved in certain areas. We found vulnerabilities in the implementation of Oblivious Transfer in each of the following libraries: - [mpecdsa](https://gitlab.com/neucrypt/mpecdsa/-/blob/cd1ac3cebf8f7d9a5700f594380e308adeb4424a/src/rot.rs): The reference implementation of DKLs19 by the authors of the protocol. Its implementation of Oblivious Transfer contains a bug that makes the TSS protocol vulnerable to a key-extraction attack by an active adversary. - [*sl-crypto*](https://github.com/silence-laboratories/sl-crypto/blob/10e477a36cbb4e0e9510cc2d9cc19aef16e1a927/crates/sl-oblivious/src/endemic_ot.rs): A commercial, professionally-audited implementation of the DKLs23 protocol. Its implementation of Oblivious Transfer contained a bug that made the TSS protocol vulnerable to a key-extraction attack by a passive adversary. - [*docknetwork/crypto*](https://github.com/docknetwork/crypto/blob/7ed83cf1b48cd7fcea81792fb21b4ee3a9a97f09/oblivious_transfer/src/base_ot/endemic_ot.rs): A library offering various cryptographic primitives, including an OT implementation that contained a bug where one of the parties inadvertently revealed its secret state. In our [full technical blog post](https://hackmd.io/@fordefi/B1x5iTMP0), we will explain the concept of Oblivious Transfer, discuss two different OT protocols, and highlight the respective vulnerabilities in the implementations of these protocols. ### Responsible Disclosure Upon discovering these vulnerabilities, we promptly informed the maintainers of each library to ensure that they were aware of the issues and could take appropriate action. We provided enough time for the maintainers to release the patches and for users of these libraries to update their systems. The maintainers of *sl-crypto* were responsible enough to acknowledge and come back with a patch within two days. They confirmed that none of the users in production were affected. The maintainers of *mpecdsa* have acknowledged the issue, and *docknetwork/crypto* have addressed the vulnerabilities and patched their code accordingly. ## Connect with us! Learn how Fordefi's MPC wallet and security platform can help you unlock your DeFi strategies. [Get Started](https://share.hsforms.com/1zs0iHCv4T2KrHGxaTT7VjAdgh7k?__hstc=58934834.e83d1cd6c335ec65eed93a25f6b8f6ac.1666883945016.1720197249757.1720448652926.394&__hssc=58934834.2.1720448652926&__hsfp=3741967887) ![](https://blog.fordefi.com/hubfs/photo_2024-07-08%2010.48.02.jpeg) ##### Aviv Frenkel Aviv Frenkel is a Researcher & Cryptography Engineer at Fordefi, focusing on Multiparty Computation. Aviv's research interests are in the areas of cryptography and cybersecurity. Share the Love [mailto:?subject=Devious%20Transfer%3A%20Breaking%20Oblivious%20Transfer-based%20Threshold%20ECDSA&body=https%3A%2F%2Fblog.fordefi.com%2Fdevious-transfer-breaking-oblivious-transfer-based-threshold-ecdsa](mailto:?subject=Devious%20Transfer%3A%20Breaking%20Oblivious%20Transfer-based%20Threshold%20ECDSA&body=https%3A%2F%2Fblog.fordefi.com%2Fdevious-transfer-breaking-oblivious-transfer-based-threshold-ecdsa) You May Like These ## Related Articles ![](https://blog.fordefi.com/hs-fs/hubfs/FORDEFI%20X%20BABYLON.png?width=700&name=FORDEFI%20X%20BABYLON.png) Company News ### [Fordefi MPC Wallet Powers Next-Gen Bitcoin DeFi with Launch of Babylon BTC Staking](https://blog.fordefi.com/fordefi-mpc-wallet-powers-next-gen-bitcoin-defi-with-launch-of-babylon-btc-staking) Fordefi has revolutionized the industry by introducing the first institutional MPC wallet solution t... Keep Reading ![](https://blog.fordefi.com/hs-fs/hubfs/Aptos%20(1).png?width=700&name=Aptos%20(1).png) Company News ### [Fordefi Unlocks DeFi on Aptos for Institutions](https://blog.fordefi.com/fordefi-unlocks-defi-on-aptos-for-institutions) Expanding our support for non-EVM blockchains, Fordefi is excited to announce that our platform now ... Keep Reading ![](https://blog.fordefi.com/hs-fs/hubfs/BYO%20EVM.png?width=700&name=BYO%20EVM.png) Product Announcement ### [Fordefi Launches BYO EVM: New Self-Serve Blockchain Integration Feature](https://blog.fordefi.com/fordefi-launches-byo-evm-new-self-serve-blockchain-integration-feature) We're thrilled to introduce Fordefi’s latest DeFi feature: the ability to add new EVM-compatible cha... Keep Reading ![Fordefi logo- horizontal - color + dark](https://blog.fordefi.com/hs-fs/hubfs/Fordefi%20logo-%20horizontal%20-%20color%20+%20dark.png?width=155&height=25&name=Fordefi%20logo-%20horizontal%20-%20color%20+%20dark.png) Founded in 2021, Fordefi is the first and only institutional MPC wallet and security platform built for decentralized finance.   [Privacy Policy](https://fordefi.com/privacypolicy) |[Terms and Conditions](https://fordefi.com/termsandconditions)