ejbca-pqc-lab

EJBCA Pure PQC Lab — ML-DSA-65 二層PKI階層 EJBCA Community Editionを使用した二層PKI階層におけるNIST FIPS 204 ML-DSAの実践的実装 📖 完全なウォークスルー: ポスト量子PKIの構築: EJBCA上でML-DSAを使用してルートCAとサブCAに署名した方法 このラボが構築するもの 2つの独立した仮想マシン上で動作する完全な純粋PQC PKI階層。各VMには独自のEJBCAコンテナがあります。 root@kitploit: VM 1 — Root CA └─ ML-DSA-65 self-signed Root ...

wolfCOSE

wolfCOSE wolfCOSEは、CBOR RFC 8949、COSE RFC 9052/9053、および wolfSSL を暗号バックエンドとして使用した耐量子 ML-DSA for COSE RFC 9964 を実装する軽量Cライブラリです。 主な機能 完全なRFC 9052メッセージセット : 6種類すべてのCOSEメッセージタイプ。複数署名者 COSESign や複数受信者 COSEEncrypt / COSEMac を含む 耐量子署名 : 3つのセキュリティレベルすべてにおけるML-DSA（FIPS 204）。RFC 9964...

CVE-2026-74877

opensslencrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revokekey method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership...

CVE-2026-74877 openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key

opensslencrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revokekey method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership...

CVE-2026-74877

openssl_encrypt versions before 1.4.0 contain a missing ownership verification flaw in the revoke_key method (keyserver/service.py, lines 195–270). The method accepts a client_id parameter but never verifies it matches key.owner_client_id, allowing any authenticated client to revoke another clien...

SUSE-SU-2026:22365-1 Security update for openCryptoki

This update for openCryptoki fixes the following issues Upgrade openCryptoki to version 3.27 jscPED-14609: Add base support for PKCS11 v3.2. Add support for PKCS11 v3.2 CVerifySignatureInit|Update|Final. Add support for PKCS11 v3.2 CEncapsulateKey/CDecapsulateKey. Soft/ICA/CCA/EP11: Add support f...

`pqcrypto-mldsa` is unmaintained: upstream PQClean project being archived

This crate provides Rust bindings to ML-DSA FIPS 204 via C implementations from PQClean. The PQClean project is being archived in or after July 2026 see PQClean/PQClean604, after which no further security patches or bug fixes will be applied to the upstream implementations. As a result, this crat...

RUSTSEC-2026-0166 `pqcrypto-mldsa` is unmaintained: upstream PQClean project being archived

This crate provides Rust bindings to ML-DSA FIPS 204 via C implementations from PQClean. The PQClean project is being archived in or after July 2026 see PQClean/PQClean604, after which no further security patches or bug fixes will be applied to the upstream implementations. As a result, this crat...

PT-2026-49125

The pqcrypto crate and the entire pqcrypto- ecosystem wrap C implementations from PQClean. The PQClean project is being archived in or after July 2026 see PQClean/PQClean604, after which no further security patches, algorithm updates, or bug fixes will be applied to the upstream implementations. ...

PT-2026-49127

This crate provides Rust bindings to ML-DSA FIPS 204 via C implementations from PQClean. The PQClean project is being archived in or after July 2026 see PQClean/PQClean604, after which no further security patches or bug fixes will be applied to the upstream implementations. As a result, this crat...

parley-core (>=0.2.0, <=0.6.1), pqc-combo (0.1.0) +2 more potentially affected by unknown CVE via libcrux-ml-dsa (>=0.0.4, <=0.0.8)

libcrux-ml-dsa CARGO version =0.0.4, =0.2.0, =0.6.1 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-FHVH-VW7H-9XF3...

parley-core (>=0.2.0, <=0.6.1), pqc-combo (0.1.0) +2 more potentially affected by unknown CVE via libcrux-ml-dsa (>=0.0.4, <=0.0.8)

libcrux-ml-dsa CARGO version =0.0.4, =0.2.0, =0.6.1 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0125...

parley-core (>=0.2.0, <=0.6.1), pqc-combo (0.1.0) +2 more potentially affected by unknown CVE via libcrux-ml-dsa (>=0.0.4, <=0.0.8)

libcrux-ml-dsa CARGO version =0.0.4, =0.2.0, =0.6.1 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0126...

CVE-2026-5194

The CVE-2026-5194 issue concerns wolfSSL’s ECDSA certificate verification: missing hash/digest size and OID checks may allow digests smaller than allowed for the given key type to pass verification when EdDSA or ML-DSA is enabled. This could reduce security of ECDSA certificate-based authenticati...

CVE-2026-5194

Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA certificate-based authentication...

pqc-combo (0.1.0), pqc-fips (0.0.3) +1 more potentially affected by unknown CVE via libcrux-ml-dsa (0.0.4)

libcrux-ml-dsa CARGO version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ml-dsa and may be impacted: - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-CP57-FQ8G-QH6V...

GHSA-CP57-FQ8G-QH6V libcrux has an Incorrect Check of Signer Response Norm During Verification

The ML-DSA verification algorithm as specified in FIPS 204, subsection 6.3 requires verifiers to check that the infinity norm of the deserialized signer response $z$ does not exceed $\gamma1 - \beta$ line 13 of Algorithm 8. The same check is required to be performed during signature generation...

libcrux-digest (>=0.0.4-pre.1, <=0.0.6), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +7 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2, <=0.0.7-pre.2)

libcrux-sha3 CARGO version =0.0.2, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =0.0.2-alpha.3 - libcrux-psq 0.0.2-beta.3 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-Q29P-9PFR-J652...

pqc-combo (0.1.0), pqc-fips (0.0.3) +1 more potentially affected by unknown CVE via libcrux-ml-dsa (0.0.4)

libcrux-ml-dsa CARGO version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ml-dsa and may be impacted: - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-XRF2-5R3P-5WGJ...

pqc-combo (0.1.0), pqc-fips (0.0.3) +1 more potentially affected by unknown CVE via libcrux-ml-dsa (0.0.4)

libcrux-ml-dsa CARGO version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ml-dsa and may be impacted: - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0076...