Hacker News Reader

This also affected the PHP library, sodium_compat. https://github.com/FriendsOfPHP/security-advisories/pull/756

I'm planning to spend my evening checking every other Ed25519 implementation I can find to see if this check is missing any where else in the open source ecosystem.

View on HN

I found several libraries that simply didn't implement the check, but none that implemented in incorrectly in the same way as the vulnerability discussed above.

If you didn't receive an email from me, either your implementation isn't listed on https://ianix.com/pub/ed25519-deployment.html, I somehow missed it, or you're safe.

Thank you for your work on free software.

My company just released a JWT library for java that supports Ed25519[0]. Any idea how I can submit that to the ianix list?

0: https://github.com/FusionAuth/fusionauth-jwt

Thank you for your work on open source.

Reply on news.ycombinator.com