GitHub Advisoryadvisory · Go

GHSA-9763-4f94-gfch CIRCL's Kyber: timing side-channel (kyberslash2)

HIGH Published 2024-01-08 Modified 2024-05-20 Official page ↗
Ecosystem
Go
Packages
github.com/cloudflare/circl
Severity
High
Reviewed
2024-01-08

Affected packages

• Go github.com/cloudflare/circl: < 1.3.7 → fixed in 1.3.7

Description

Impact On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key. Does not apply to ephemeral usage, such as when used in the regular way in TLS. Patches Patched in 1.3.7. References • kyberslash.cr.yp.to

References