Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hiero-ledger/hiero-cryptography

              main @ 39f28f3
            

Fixes

CVEs

CRITICAL

Peak severity

60.0%

Coverage

Highlights

Cryptographic Validation Bypass: 5 prior fixes. Scrutinize any change in this area.

cryptography/hedera-cryptography-hints/src/main/rust/hints.rs: most-fixed (5 issues). Treat as high-risk during review.

18 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cryptographic Validation Bypass: Multiple fixes address insecure Fiat-Shamir challenge derivation and missing proof-of-possession, enabling proof forgery and rogue-key attacks.

Cryptographic Verification Bypass: Pairing verification logic was repeatedly corrected to use proper CRS elements and add checks, preventing forged hints from passing.

Signature Verification Bypass: Threshold comparison bug (>= vs >) allowed network partition forgery; strict threshold enforcement is critical.