torchat

TorChat - 匿名P2Pチャット Torネットワーク上で安全、プライベート、そして匿名のピアツーピアチャット。 TorChatとは？ 中央サーバーを介さずに、Torネットワーク上で直接他の人と通信できる、軽量でプライバシーを最優先にしたメッセージングツールです。プライバシー、セキュリティ、そしてシンプルさを重視する人のために設計されています。 TorChatが特別な理由 TorChatは本当にクールです。 他のツールにはないクールな機能を備えています。 永続的なアドレスを使用する標準的なTorチャットシステムとは異なり、この実装は完全に一時的（エフェメラル）です。 ゼロ永続性:...

Concryptor

Concryptor Rust로 작성된 멀티스레드 AEAD 암호화 엔진입니다. 삼중 버퍼 iouring 파이프라인, Rayon을 통한 병렬 청크 처리, ring을 통한 어셈블리 최적화 암호를 사용하여 기가바이트/초 처리량으로 파일을 암호화 및 복호화합니다. ⚠️ 면책 조항: 실험적 소프트웨어 ⚠️ 이 프로젝트는 매우 초기 단계이며 현재 프로덕션 또는 중요 업무용으로 권장되지 않습니다. 암호화 프리미티브AES-256-GCM, ring을 통한 ChaCha20-Poly1305와 형식 설계는 건전하지만, 코드베이스는 공식적인 보안 감사나...

CESS

CESS — 암호학적으로 강화된 샤미르 비밀 이것은 AI 헛소리인가요, 저질인가요? 암호학자나 진지한 구현자가 CESS를 검토할 때는 일반적으로 산문을 읽기 전에 vectors/와 testdata/를 엽니다. 테스트 스위트는 작업 증명입니다: 이야기만으로는 대체할 수 없는 도메인 지식을 인코딩합니다. 그렇다고 해서 다른 사람들에게 요점을 숨길 이유는 없습니다. 조달을 위해 프로젝트를 평가하거나, 기여 여부를 결정하거나, 정책을 작성하거나, 암호화 테스트 방법론에 대한 깊은 교육 없이 코드를 출시하는 사람들도 구체적인 증거를 가...

Rocky Linux 9 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc (crlsa-2025_23483)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523483 advisory. libssh: Invalid return code for chacha20 poly1305 with OpenSSL backend CVE-2025-5987 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 10.1 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc (crlsa-2025_23484)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523484 advisory. libssh: Invalid return code for chacha20 poly1305 with OpenSSL backend CVE-2025-5987 Tenable has extracted the preceding description block directly from the CIQ...

PT-2026-96272

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description An issue exists in the PSA Internal Trusted Storage ITS transform module where the function secure storage its transform aead get nonce uses unsynchronized function-local static variables s...

CVE-2026-15890: Reusing a Nonce, Key Pair in Encryption

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

Astra Linux – Vulnerabilities in paramiko, libssh, libssh2, erlang, openssh

The SSH transport protocol, with certain OpenSSH extensions, found in OpenSSH versions prior to 9.6 and other products, allows remote attackers to bypass integrity checks. As a result, some packets may be omitted from the extension negotiation message. Consequently, the client and server may end ...

Astra Linux – Vulnerability in nss

A flaw was discovered in the implementation of CHACHA20-POLY1305 in NSS versions prior to 3.55. When using multi-part Chacha20, it could lead to out-of-bounds reads. This issue was addressed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and enforcing strict tag...

openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()

A flaw in OpenSSL causes EVPCipher to skip AEAD tag verification for ChaCha20-Poly1305 and AES-OCB ciphers when decrypting empty ciphertexts. This allows remote attackers to submit forged messages that affected applications incorrectly accept as valid...

SUSE CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the chacha20poly1305cipher and aesocbcipher implementations under providers/implementations/ciphers/. An attacker can forge messages by supplying an empty ciphertext and a bad tag, then...

AZL-97884 CVE-2026-75803 affecting package edk2 for versions less than 20240524git3e722403cd16-20

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

AZL-97671 CVE-2026-75803 affecting package openssl-fips-provider 3.1.2-2

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

AZL-97935 CVE-2026-75803 affecting package openssl for versions less than 3.3.7-6

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

ALPINE-CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

EUVD-2026-65488

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

CVE-2026-75803 AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

CVE-2026-75803 AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...