Advisories for Cargo/Cggmp21 package

This attack is against presignatures used in very specific context: Presignatures + HD wallets derivation: security level reduces to 85 bits Previously users could generate a presignature, and then choose a HD derivation path while issuing a partial signature via Presignature::set_derivation_path, which is malleable to attack that reduces target security level. To mitigate, this method has been removed from API. Presignatures + "raw signing" (when signer signs a hash without …

cggmp21 concerns a missing check in the ZK proof that enables an attack in which a single malicious signer can reconstruct full private key.

Challenge derivation in non-interactive ZK proofs was ambiguous and that could lead to security vulnerability (however, it's unknown if it could be exploited).