Concryptor

Concryptor 一个用 Rust 构建的多线程 AEAD 加密引擎。使用三重缓冲的 iouring 流水线、通过 Rayon 实现的并行分块处理以及通过 ring 实现的汇编优化密码，以每秒千兆字节的吞吐量加密和解密文件。 ⚠️ 免责声明：实验性软件 ⚠️ 该项目极其新，目前不建议用于生产或关键任务场景。 虽然加密原语（通过 ring 的 AES-256-GCM、ChaCha20-Poly1305）和格式设计是可靠的，但代码库尚未经过正式安全审计或广泛的实际测试。使用风险自负。如需保护敏感数据，请考虑使用经过实战检验的工具（如 GnuPG、age 或 OpenSSL），直到该项目成熟。...

torchat

TorChat - Anonymous P2P Chat Secure, private, and anonymous peer-to-peer chat over the Tor network. What is TorChat? its a lightweight, privacy-first messaging tool that lets you communicate directly with others over the Tor network—without any central servers. It's designed for those who care...

CESS

CESS — 密码学增强的沙米尔秘密共享 这是人工智能的胡扯还是劣质内容？ 一位密码学家或严肃的实现者在审查 CESS 时，通常会先打开 vectors/ 和 testdata/，然后再阅读文字描述。测试套件就是工作证明：它编码了领域知识，而这些知识仅靠叙述是无法替代的。 这并不意味着要向其他人隐藏要点。评估项目以决定采购、是否贡献、制定政策、或者在没有深入加密测试方法培训的情况下发布代码的人们，仍然需要一个指向具体证据的指引。该仓库已经声明了审计规则和算法排除项；将这些叙述与已发布的测试向量 关联起来，弥合了“页面上的声明”与“可运行的工件”之间的差距。 查看内容： 一致性材料包括 R...

Rocky Linux 10.1 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc (crlsa-2025_23484)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523484 advisory. libssh: Invalid return code for chacha20 poly1305 with OpenSSL backend CVE-2025-5987 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc (crlsa-2025_23483)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523483 advisory. libssh: Invalid return code for chacha20 poly1305 with OpenSSL backend CVE-2025-5987 Tenable has extracted the preceding description block directly from the CIQ...

PT-2026-96272

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description An issue exists in the PSA Internal Trusted Storage ITS transform module where the function secure storage its transform aead get nonce uses unsynchronized function-local static variables s...

CVE-2026-15890: Reusing a Nonce, Key Pair in Encryption

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

Astra Linux – Vulnerabilities in paramiko, libssh, libssh2, erlang, openssh

The SSH transport protocol, with certain OpenSSH extensions, found in OpenSSH versions prior to 9.6 and other products, allows remote attackers to bypass integrity checks. As a result, some packets may be omitted from the extension negotiation message. Consequently, the client and server may end ...

Astra Linux – Vulnerability in nss

A flaw was discovered in the implementation of CHACHA20-POLY1305 in NSS versions prior to 3.55. When using multi-part Chacha20, it could lead to out-of-bounds reads. This issue was addressed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and enforcing strict tag...

openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()

A flaw in OpenSSL causes EVPCipher to skip AEAD tag verification for ChaCha20-Poly1305 and AES-OCB ciphers when decrypting empty ciphertexts. This allows remote attackers to submit forged messages that affected applications incorrectly accept as valid...

SUSE CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the chacha20poly1305cipher and aesocbcipher implementations under providers/implementations/ciphers/. An attacker can forge messages by supplying an empty ciphertext and a bad tag, then...

CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

AZL-97884 CVE-2026-75803 affecting package edk2 for versions less than 20240524git3e722403cd16-20

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

AZL-97671 CVE-2026-75803 affecting package openssl-fips-provider 3.1.2-2

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

ALPINE-CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

AZL-97935 CVE-2026-75803 affecting package openssl for versions less than 3.3.7-6

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

EUVD-2026-65488

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

CVE-2026-75803 AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

CVE-2026-75803 AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...