ml-kem-key-recovery

wolfSSL ML-KEMにおける部分的なFujisaki-Okamoto比較からの完全な鍵回復 CVE-2026-6330（NEON）および CVE-2026-10097（AVX2）。wolfSSL 5.9.2で修正済み。 完全な技術解説は Cryptology ePrint Archive, Paper 2026/1682として公開されています （ローカルコピーはpaper/）。下記の引用を参照してください。 はじめに ML-KEM（Kyber、FIPS 203）は、 復号化内部の1つのチェックにより 選択暗号文攻撃に耐性を持ちます。...

mlkem-native

mlkem-native mlkem-native は、ML-KEM1 の安全で高速かつ移植性に優れた C902 実装です。 これは ML-KEM リファレンス実装3 のフォークです。 mlkem/src/ および mlkem/src/fips202/ 内のすべての C コードは、CBMC4 を用いてメモリ安全性（メモリオーバーフローなし）と型安全性（整数オーバーフローなし）が証明されています。すべての AArch64 および x8664 アセンブリは、HOL-Light5 を用いて、機能的に正しく、メモリ安全であり、秘密情報に依存しないタイミング（定数時間）であることが証明されています...

kroxylicious-pqc-filter

Kroxylicious PQC レコード暗号化フィルター Kroxylicious フィルタープラグイン。透過的な 耐量子暗号 PQC レコードレベル暗号化を Apache Kafka 向けに提供し、 ML-KEM FIPS 203 鍵カプセル化と AES-256-GCM 対称暗号化を使用します。 Kafka プロデューサーとコンシューマーは コード変更が一切不要 です。Kroxylicious プロキシが トラフィックをインターセプトし、Produce 時に暗号化し、Fetch 時に自動的に復号化します。 Producer ──plaintext── Kroxylicious...

camel-pqc-tls

Apache Camel によるポスト量子 TLS このリポジトリには、X25519MLKEM768 ハイブリッド鍵交換を使用し、Apache Camel で ポスト量子暗号 PQC TLS 1.3 ハンドシェイク を実演する3つの例が含まれています。 X25519MLKEM768 は、古典的なX25519 楕円曲線ディフィー・ヘルマンと、ポスト量子の格子ベース鍵カプセル化メカニズムである ML-KEM-768 NIST FIPS 203 を組み合わせたものです。両アルゴリズムが連携して動作するため、片方が破られてもセキュリティは維持されます。 例 Example| JDK| TLS...

CVE-2024-14041

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...

Linux Distros Unpatched Vulnerability : CVE-2026-6330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2...

CVE-2026-6330

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

CVE-2026-6330

CVE-2026-6330 : In ML-KEM targeting ARM64 NEON, the ciphertext comparison only checks half of the input. This breaks the Fujisaki-Okamoto transform’s implicit rejection, weakening IND-CCA2 security on that path. The constant-time comparison thus ignores part of the re-encrypted ciphertext, allowi...

CVE-2026-6330 ML-KEM ARM64 NEON ciphertext comparison only compares half of the input

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

CVE-2026-10097 ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery

wolfSSL's AVX2-optimized ML-KEM implementation mlkemcmpavx2 compares only 1536 of the 1568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check in ML-KEM-1024 decapsulation. Ciphertexts that differ from the expected re-encryption solely in bytes 1536-1567 bypass implicit rejection and...

CVE-2026-10097

Summary: CVE-2026-10097 affects wolfSSL’s ML-KEM-1024 x64 AVX2 implementation. The Fujisaki-Okamoto decapsulation path performs an incomplete ciphertext check, failing to compare the final portion of the 1568-byte ciphertext. As a result, ciphertexts manipulated in those final bytes can bypass im...

CVE-2026-10097

wolfSSL's AVX2-optimized ML-KEM implementation mlkemcmpavx2 compares only 1536 of the 1568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check in ML-KEM-1024 decapsulation. Ciphertexts that differ from the expected re-encryption solely in bytes 1536-1567 bypass implicit rejection and...

SUSE-SU-2026:22365-1 Security update for openCryptoki

This update for openCryptoki fixes the following issues Upgrade openCryptoki to version 3.27 jscPED-14609: Add base support for PKCS11 v3.2. Add support for PKCS11 v3.2 CVerifySignatureInit|Update|Final. Add support for PKCS11 v3.2 CEncapsulateKey/CDecapsulateKey. Soft/ICA/CCA/EP11: Add support f...

PT-2026-52560

Name of the Vulnerable Software and Affected Versions wolfSSL affected versions not specified Description The AVX2-optimized ML-KEM implementation contains a logic error in the mlkem cmp avx2 function during the Fujisaki-Okamoto transform. In ML-KEM-1024 decapsulation, the constant-time ciphertex...

`pqcrypto-mlkem` is unmaintained: upstream PQClean project being archived

This crate provides Rust bindings to ML-KEM FIPS 203 via C implementations from PQClean. The PQClean project is being archived in or after July 2026 see PQClean/PQClean604, after which no further security patches or bug fixes will be applied to the upstream implementations. As a result, this crat...

PT-2026-49125

The pqcrypto crate and the entire pqcrypto- ecosystem wrap C implementations from PQClean. The PQClean project is being archived in or after July 2026 see PQClean/PQClean604, after which no further security patches, algorithm updates, or bug fixes will be applied to the upstream implementations. ...

libcrux-digest (>=0.0.4-pre.1, <=0.0.6), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +7 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2, <=0.0.7-pre.2)

libcrux-sha3 CARGO version =0.0.2, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =0.0.2-alpha.3 - libcrux-psq 0.0.2-beta.3 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-Q29P-9PFR-J652...

libcrux-digest (>=0.0.4-pre.1, <=0.0.6), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +7 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2, <=0.0.7-pre.2)

libcrux-sha3 CARGO version =0.0.2, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =0.0.2-alpha.3 - libcrux-psq 0.0.2-beta.3 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0074...

GHSA-2CGV-28VR-RV6J libcrux incorrectly calculates on aarch64

On platforms without the core::arch::aarch64::vxarqu64 intrinsic, an unverified fallback in libcrux-intrinsics v0.0.3 passed incorrect arguments and produced wrong results. This corrupted SHA-3 digests and caused libcrux-ml-kem and libcrux-ml-dsa to sample incorrectly, yielding incorrect shared...

RUSTSEC-2025-0133 Incorrect calculation on aarch64

On platforms without the core::arch::aarch64::vxarqu64 intrinsic, an unverified fallback in libcrux-intrinsics v0.0.3 passed incorrect arguments and produced wrong results. This corrupted SHA-3 digests and caused libcrux-ml-kem and libcrux-ml-dsa to sample incorrectly, yielding incorrect shared...