PQCrypto-LWEKE

FrodoKEM: Learning with Errors Key Encapsulation This C library implements FrodoKEM , an IND-CCA secure key encapsulation KEM protocol based on the well-studied Learning with Errors LWE problem 1,3, which in turn has close connections to conjectured-hard problems on generic, "algebraically...

fips203

NCC Group: FIPS 203 Module-Lattice-Based Key-Encapsulation Mechanism Standard FIPS 203 Initial Public Draft Module-Lattice-Based Key-Encapsulation Mechanism Standard written in pure Rust for server, desktop, browser and embedded applications. The source repository includes examples demonstrating...

rust_citadel

Citadel Post-quantum hybrid encryption and key management server. Citadel combines X25519 + ML-KEM-768 for key encapsulation and AES-256-GCM for data encryption, following NIST's hybrid approach for the post-quantum transition. Applications encrypt and decrypt data through a REST API. Citadel...

liboqs

liboqs liboqs è una libreria C open source per algoritmi crittografici quantum-safe. liboqs Panoramica Stato Algoritmi supportati Meccanismi di incapsulamento delle chiavi Schemi di firma Schemi di firma con stato Limitazioni e sicurezza Limitazioni della piattaforma Limitazioni del supporto Avvi...

Future-Proofing the Internet: Akamai Achieves End-to-End PQC

...

CVE-2026-74900

opensslencrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain...

Python Now Has a Post-Quantum Encryption Library

This is good: Post-quantum cryptography is now one pip-install away for the entire Python ecosystem. With funding from the Sovereign Tech Agency, we implemented support for ML-KEM, the NIST-standard key-establishment primitive, and ML-DSA, the NIST-standard digital-signature primitive, in...

Security update for liboqs, oqs-provider

This update for liboqs, oqs-provider fixes the following issues: disable KEMHQC and SIGMQOM and KEMNTRUPRIME on s390x for now, testsuite shows them not working. Updated to 0.16.0: Deprecation notice: SPHINCS+ was removed in 0.16.0. Security issues: Fixed uninitialized encapsderand pointer...

CVE-2024-14041 ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...

CVE-2024-14041

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...

JLSEC-2026-748 The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the...

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key

A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without prope...

openSUSE 16 Security Update : openCryptoki (openSUSE-SU-2026:21059-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21059-1 advisory. This update for openCryptoki fixes the following issues Upgrade openCryptoki to version 3.27 jscPED-14609: Add base support for PKCS11 v3.2. Add...

EulerOS 2.0 SP15 : openssl (EulerOS-SA-2026-2497)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Applications using RSASVE key encapsulation to establishx000D a secret encryption key can send contents of an uninitialized memory...

DEBIAN-CVE-2026-6330

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

CVE-2026-6330

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

UBUNTU-CVE-2026-6330

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

CVE-2026-6330

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

CVE-2026-6330

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating par...

DEBIAN-CVE-2026-10097

wolfSSL's AVX2-optimized ML-KEM implementation mlkemcmpavx2 compares only 1536 of the 1568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check in ML-KEM-1024 decapsulation. Ciphertexts that differ from the expected re-encryption solely in bytes 1536-1567 bypass implicit rejection and...