MEDIUM

GHSA-hrjv-pf36-jpmr

oqs's Post-Quantum Key Encapsulation Mechanism SIKE broken

Details

Wouter Castryck and Thomas Decru presented an efficient key recovery attack on the SIDH protocol. As a result, the secret key of SIKEp751 can be recovered in a matter of hours. The SIKE and SIDH schemes will be removed from oqs 0.7.2.

[An efficient key recovery attack on SIDH (preliminary version)](https://eprint.iacr.org/2022/975)

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/oqs

Introduced in: 0Fixed in: 0.7.2

Upgrade oqs to 0.7.2 or newer (ecosystem crates.io).

References

https://github.com/open-quantum-safe/liboqs-rust/pull/151[WEB]
https://github.com/open-quantum-safe/liboqs-rust[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2022-0045.html[WEB]