PQCrypto-LWEKE

FrodoKEM：基于带误差学习问题的密钥封装 该C语言库实现了 FrodoKEM ，一种基于已被充分研究的带误差学习（LWE）问题 1,3 的 IND-CCA 安全密钥封装（KEM）协议，而 LWE 问题又与通用“代数非结构化”格上的猜想困难问题密切相关。本软件包还包含 Python 参考实现。FrodoKEM 被推测能够抵御量子计算机攻击。 FrodoKEM 包含两个主要变体： 一个 标准 变体（简称为 FrodoKEM ），不对密钥对的重用施加任何限制（即，它适用于大量密文可能被加密到单个公钥的应用场景），以及 一个 临时 变体（称为 eFrodoKEM...

EUVD-2026-39570

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

CVE-2026-6330

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

CVE-2026-6330 ML-KEM ARM64 NEON ciphertext comparison only compares half of the input

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

PT-2026-52603

Name of the Vulnerable Software and Affected Versions ML-KEM affected versions not specified Description An issue exists in the ARM64 NEON ciphertext comparison where only half of the input is compared. This failure breaks the implicit rejection of the Fujisaki-Okamoto transform—a method used to...

PT-2026-52560

Name of the Vulnerable Software and Affected Versions wolfSSL affected versions not specified Description The AVX2-optimized ML-KEM implementation contains a logic error in the mlkem cmp avx2 function during the Fujisaki-Okamoto transform. In ML-KEM-1024 decapsulation, the constant-time ciphertex...