Baby Sharks: Small Subgroup Attacks on DKG Implementations
summary
Claims that common DKG code skips subgroup sanitization and so allows concrete attacks on implementations using Curve25519 and BLS12-381. Uses analysis of Feldman VSS and Schnorr-style ECDL proofs to show a single malicious party can fake a proof when the cofactor 8 yields a 1/8 success chance, while VSS can be forged by controlling enough shares (example n=5, t=3 requires control of 2 malicious parties). Demonstrates breakages against threshold EdDSA, chained BLS beacons and finds real vulnerable deployments including a major exchange and a top‑50 blockchain.
AI-written summary · about
chapters (11)
- 0:00Introduction and overview
- 1:44Elliptic curve background
- 3:45Distributed key generation
- 6:31Standard Schnorr proof
- 7:25Attacking proof of knowledge
- 8:43Attacking secret sharing
- 10:28Summary of vulnerabilities
- 11:40Real world applications
- 14:21Random beacons and blockchain
- 15:49Mitigation and conclusions
- 16:45Q&A session
related talks
28mAsynchronous Distributed Key Generation
41mFault Attacks & Side Channels
01h 13mHow Diffie-Hellman Fails in Practice
27mTSSHOCK: Breaking MPC Wallets and Digital Custodians for $BILLION$ Profit
36mSmall Leaks, Billions Of Dollars: Practical Cryptographic Exploits That Undermine Crypto Wallets
34mCryptographic Vulnerabilities in Threshold Wallets
39mWhen Is a Proof Actually Not?
24mA Decade After Bleichenbacher '06, RSA Signature Forgery Still Works