Aareon/ChickenTicket

Minerva timing attack on P-256 in python-ecdsa

Open

#53 opened on Mar 24, 2024

View on GitHub
 (2 comments) (0 reactions) (1 assignee)Python (2 forks)auto 404
help wantedhigh-priority

Repository metrics

Stars
 (17 stars)
PR merge metrics
 (PR metrics pending)

Description

https://github.com/Aareon/ChickenTicket/security/dependabot/17

Replace python-ecdsa dependency with alternative.

Contributor guide

Research direction
Review the Minerva timing attack details and replace python ecdsa with a secure alternative like the 'cryptography' library.
Tech stack
python
Domain
backendblockchain
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitPython
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75