The previously existing polynomial coefficients had an inverse bias
towards `0`, only starting higher than `1`. This allows `0` to be a
valid polynomial.
As per an audit performed by Cure53:
> The correct method to select a random polynomial would be to select
all coefficients (including the most significant coefficient) uniformly
in the range 0..255 (inclusive). Otherwise, knowledge that a coefficient
in a polynomial cannot be 0 permits the exclusion of single byte values
for the shared secret given one share less than required. [...]
Exploiting this weakness necessitates sharing the same secret multiple
times. In this scenario, an attacker could exclude an exponential number
of values for each of the shared bytes until sufficiently few values
remain for brute forcing. Cure53 estimates that under ideal
circumstances (e.g., a 2-out-of-N scheme) a shared secret can be
reconstructed if the same secret has been distributed 500-1500 times.
* Add Zeroize crate to project behind a default feature flag
Closes https://github.com/c0dearm/sharks/issues/8
* Switch match to Clone to add zeroize(drop)
* Add zeroize(drop) to Share
Co-authored-by: Aitor Ruano <45633475+c0dearm@users.noreply.github.com>
Ryan Heywood
Garrett T
Kitsu
Aitor Ruano
zer0x64
Aitor Ruano