GitHub Advisoryadvisory · crates.io

GHSA-q29p-9pfr-j652 libcrux-sha3: Incorrect output from SHAKE squeeze functions

HIGH Published 2026-03-26 Modified 2026-03-26 Official page ↗
Ecosystem
crates.io
Packages
libcrux-sha3
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-682
Reviewed
2026-03-26

Affected packages

• crates.io libcrux-sha3: < 0.0.8 → fixed in 0.0.8

Description

The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than `RATE` (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of `RATE` bytes of valid XOF output. Impact This bug impacts users that rely on this XOF API to squeeze more than `RATE` bytes. It does not impact the use of libcrux-sha3 in libcrux-ml-kem or libcrux-ml-dsa. Mitigation Starting from version `0.0.8` the squeeze functions correctly output all blocks including the first block.

Related

Weakness · CWE (1)

  • CWE-682 Incorrect Calculation weakness

References