RUSTSEC-2026-0240: Ed25519 identity public keys permit universal signature forgery

What to do

1. See which version you have: cargo tree -i dcrypt-sign (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p dcrypt-sign. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example dcrypt-sign = "2.0.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

All published versions of dcrypt-sign before 2.0.0 accepted the Edwards identity as an Ed25519 public key. A signature with R = B and S = 1 then verified for every message because the challenge term multiplied the identity. The implementation also admitted other noncanonical or small-order inputs. Consumers that accepted externally supplied dcrypt Ed25519 keys may therefore have accepted forged authorizations.

Version 2.0.0 replaces the custom arithmetic with ed25519-dalek, uses strict verification, and rejects noncanonical, small-order, and non-torsion-free public keys and R values, as well as noncanonical S >= L. No wrapper around the affected verifier is recommended as a complete workaround. Upgrade to 2.0.0 or later, audit registered keys and trust stores, and review historical actions authorized with externally supplied keys.

References

• Package: crates.io/crates/dcrypt-sign
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0240.html
• Web: github.com/ioi-foundation/dcrypt/commit/c99cc86f0ee353010cd202cbcd2c310371b0bbb8
• Web: github.com/ioi-foundation/dcrypt/commit/c99cc86f0ee353010cd202cbcd2c310371b0bbb8
• Web: github.com/ioi-foundation/dcrypt/releases/tag/v2.0.0

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.