GHSA-f6jh-hvg2-9525

Source

https://github.com/advisories/GHSA-f6jh-hvg2-9525

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-f6jh-hvg2-9525/GHSA-f6jh-hvg2-9525.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-f6jh-hvg2-9525

Aliases

GO-2024-2469

Published

2024-01-17T22:06:20Z

Modified

2024-05-20T22:05:23Z

Summary

crystals-go vulnerable to KyberSlash (timing side-channel attack for Kyber)

Details

Impact

On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key.

Patches

Patched in https://github.com/kudelskisecurity/crystals-go/pull/21

Note

This library was written as part of a MsC student project in the Cybersecurity Team at Kudelski Security. It is not actively maintained anymore. It is only intended for research and testing. We discourage its use in any production environment. Kudelski Security does not use this library as part of their commercial offers or product. This has now been clarified on the project's README.

References

https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/ldX0ThYJuBo http://kyberslash.cr.yp.to/

Database specific

{
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [],
    "github_reviewed_at": "2024-01-17T22:06:20Z",
    "nvd_published_at": null
}

References

Affected packages

Go / github.com/kudelskisecurity/crystals-go

Package

Name: github.com/kudelskisecurity/crystals-go; View open source insights on deps.dev
Purl: pkg:golang/github.com/kudelskisecurity/crystals-go

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20240116172146-2a6ca2d4e64d