Release v1.0.4
Security Fix
- tss4j: updated to 0.0.10. It includes a correctness fix in GG20 MtA proof flow.
Malicious co-signer could forge MtA range proofs, enabling full secret share recovery in O(log q) signing sessions
via binary oracle on the respondent's secret share.
Recommended action
Upgrade immediately. If prior sessions involved untrusted co-signers, consider performing a key refresh.
Performance
- Switched to virtual threads per request
- Replaced BigInt text serialization with byte array encoding for internal
communications - Server configuration fine-tuning