GitHub Advisoryadvisory · crates.io

GHSA-h864-m8vm-3xvj oqs's Post-Quantum Signature scheme Rainbow level I parametersets broken

HIGH Published 2022-08-18 Modified 2022-08-18 Official page ↗

Ecosystem: crates.io
Packages: oqs
Severity: High
Reviewed: 2022-08-18

Affected packages

• crates.io oqs: < 0.7.2 → fixed in 0.7.2

Description

Ward Beullens found a practical key-recovery attack against Rainbow. The level I parametersets are removed from liboqs starting from version `0.7.2`. Find the scientific details in Breaking Rainbow Takes a Weekend on a Laptop. This means all the `oqs::sig::Algorithm::RainbowI*` variants are insecure.

References

https://github.com/open-quantum-safe/liboqs-rust package
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/KFgw5_qCXiI?pli=1 web
https://rustsec.org/advisories/RUSTSEC-2022-0047.html web