Z-Sigil: A Public-Key Cryptosystem with Chained Selection over a Fiber Bundle of Module-Lattice Keys

Z-Sigil is a public-key cryptosystem in which the plaintext selects successive keys from a fixed module-lattice family. Messages are length-prefixed, zero-padded and divided into 32-byte blocks. Each public vector is a shared public matrix applied to a small secret vector, plus a small error. Key...

SUSE CVE-2024-14041

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...

Linux Distros Unpatched Vulnerability : CVE-2026-64304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: qat - validate RSA CRT component lengths The generic RSA key parser rsahelper.c bounds each CRT component p, q, dp, dq, qinv by the modulus size nsz, bu...

Pseudonym Scheme Based on Hybrid Certificates for Security Credential Management System in Vehicular Communications

In recent years, the Institute of Electrical and Electronics Engineers IEEE and the European Telecommunications Standards Institute ETSI have developed a series of security communication standards for vehicular communications. These standards include mechanisms such as the Security Credential...

Correctness of Extended RSA Public Key Cryptosystem

This paper proposes an alternative approach to formally establishing the correctness of the RSA public key cryptosystem. The methodology presented herein deviates slightly from conventional proofs found in existing literature. Specifically, this study explores the conditions under which the choic...

EUVD-2024-48031

Malicious code in bioql PyPI...

The Rabin Cryptosystem over Number Fields

We extend Rabin's cryptosystem to general number fields. We show that decryption of a random plaintext is as hard as the integer factorisation problem, provided the modulus in our scheme has been chosen carefully. We investigate the performance of our new cryptosystem in comparison with the...

libgcrypt: vulnerable to Marvin Attack

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts...

CVE-2024-7010 Timing Attack in mudler/localai

mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. Specifically, in the context of password handling, an attacker can determine valid...

CVE-2024-7010 Timing Attack in mudler/localai

mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. Specifically, in the context of password handling, an attacker can determine valid...

CVE-2024-7010

The CVE-2024-7010 entry concerns mudler/localai version 2.17.1 and a Timing Attack vulnerability in password handling that leaks credentials by measuring cryptographic operation timing. This is a network-accessible side-channel issue with reported confidentiality impact, and multiple sources (NVD...

CVE-2024-7010 Timing Attack in mudler/localai

mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. Specifically, in the context of password handling, an attacker can determine valid...

LocalAI 信息泄露漏洞

LocalAI is a free, open source alternative to OpenAI from the individual developer Ettore Di Giacinto. An information disclosure vulnerability exists in LocalAI version 2.17.1, which stems from vulnerability to timing attacks that allow an attacker to compromise a cryptosystem by analyzing the ti...

CVE-2024-7010: Observable Timing Discrepancy

mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. Specifically, in the context of password handling, an attacker can determine valid...

Why We Don’t Generate Elliptic Curves Every Day

With all the talk recently of how the NIST curve parameters were selected, a reasonable observer could wonder why we all use the same curves instead of generating them along with keys, like we do for Diffie-Hellman parameters. You might have memories of waiting around for openssl dhparam to run a...

CVE-2023-26557

io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/paillier.go. bnb-chain/tss-lib and...

SUSE CVE-2015-7744

wolfSSL formerly CyaSSL before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem CRT process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS...

No, RSA Is Not Broken

I have been seeing this paper by cryptographer Peter Schnorr making the rounds: "Fast Factoring Integers by SVP Algorithms." It describes a new factoring method, and its abstract ends with the provocative sentence: "This destroys the RSA cryptosystem." It does not. At best, its an improvement in...

IBM Worklight and Mobile Foundation Weak Password Vulnerability

IBM Worklight and Mobile Foundation are both products of IBM Corporation in the U.S. IBM Worklight is a suite of integrated development environments IDEs for developing, testing, running, and managing mobile applications.Mobile Foundation is a suite of software for rapidly creating mobile and...

SpiderSales 2.0 Shopping Cart Multiple Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/9799/info Multiple vulnerabilities have been identified in the application that may allow an attacker to obtain the private cryptographic key and gain access to sensitive information. The application is also reported pron...