Skip to content
This repository has been archived by the owner on Jan 16, 2024. It is now read-only.

KyberSlash (timing side-channel attack for Kyber)

High
tgkudelski published GHSA-f6jh-hvg2-9525 Jan 16, 2024

Package

gomod crystals-go (Go)

Affected versions

all before 2024-01-16

Patched versions

2024-16-01 and later

Description

Impact

On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key.

Patches

Patched in #21

Note

This library was written as part of a MsC student project in the Cybersecurity Team at Kudelski Security. It is not actively maintained anymore. It is only intended for research and testing. We discourage its use in any production environment. Kudelski Security does not use this library as part of their commercial offers or product. This has now been clarified on the project's README.

References

https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/ldX0ThYJuBo
http://kyberslash.cr.yp.to/

Severity

High

CVE ID

No known CVE

Weaknesses

No CWEs