Ed25519 identity public keys permit universal signature forgery

Summary

All published versions of `dcrypt-sign` before 2.0.0 accepted the Edwards identity as an Ed25519 public key. A signature with `R = B` and `S = 1` then verified for every message because the challenge term multiplied the identity. The implementation also admitted other noncanonical or small-order inputs. Consumers that accepted externally supplied dcrypt Ed25519 keys may therefore have accepted forged authorizations.

Version 2.0.0 replaces the custom arithmetic with `ed25519-dalek`, uses strict verification, and rejects noncanonical, small-order, and non-torsion-free public keys and `R` values, as well as noncanonical `S >= L`. No wrapper around the affected verifier is recommended as a complete workaround. Upgrade to 2.0.0 or later, audit registered keys and trust stores, and review historical actions authorized with externally supplied keys.