Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1oODY0LW04dm0tM3h2as4AAuFr

oqs's Post-Quantum Signature scheme Rainbow level I parametersets broken

Ward Beullens found a practical key-recovery attack against Rainbow.
The level I parametersets are removed from liboqs starting from version 0.7.2.
Find the scientific details in Breaking Rainbow Takes a Weekend on a Laptop.

This means all the oqs::sig::Algorithm::RainbowI* variants are insecure.

Permalink: https://github.com/advisories/GHSA-h864-m8vm-3xvj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oODY0LW04dm0tM3h2as4AAuFr
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 2 years ago

Identifiers: GHSA-h864-m8vm-3xvj
References:

• https://github.com/open-quantum-safe/liboqs-rust
• https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/KFgw5_qCXiI?pli=1
• https://rustsec.org/advisories/RUSTSEC-2022-0047.html
• https://github.com/advisories/GHSA-h864-m8vm-3xvj

Repository: https://github.com/open-quantum-safe/liboqs-rust
Blast Radius: 0.0

Affected Packages