VDB
KO
LOW

GHSA-435g-fcv3-8j26

Bug-Fixes in `libcrux-ecdh`, `libcrux-ed25519`, `libcrux-psq`

Details

In accordance with our [security policy for `libcrux`](https://github.com/cryspen/libcrux/blob/main/SECURITY.md), we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the `libcrux-ecdh`, `libcrux-ed25519` and `libcrux-psq` crates contain the following bug-fixes:

## `libcrux-ecdh`

- [#1301](https://github.com/cryspen/libcrux/pull/1301): Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length

## `libcrux-ed25519`

- [#1320](https://github.com/cryspen/libcrux/pull/1320): Remove duplicated clamping step during key generation

The issue fixed in #1320 was first reported by Nadim Kobeissi. ## `libcrux-psq`

- [#1319](https://github.com/cryspen/libcrux/pull/1319): Propagate AEADError instead of panicking - [#1301](https://github.com/cryspen/libcrux/pull/1301): Fix broken clamping check for imported X25519 secret keys

The issue fixed in #1319 was first reported by Nadim Kobeissi.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io / libcrux-ecdh
Introduced in: 0 Fixed in: 0.0.6

Upgrade libcrux-ecdh to 0.0.6 or newer (ecosystem crates.io).

crates.io / libcrux-ed25519
Introduced in: 0 Fixed in: 0.0.6

Upgrade libcrux-ed25519 to 0.0.6 or newer (ecosystem crates.io).

crates.io / libcrux-psq
Introduced in: 0 Fixed in: 0.0.7

Upgrade libcrux-psq to 0.0.7 or newer (ecosystem crates.io).

References