Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

pqcrypto-hqc

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    PQClean has a correctness error in HQC decapsulation

    GHSA-753p-wrj5-g8fj

    Affected
    • crates.io pqcrypto-hqc < 0.2.1
    Fixed in
    0.2.1· Vendor fix available
    Issue
    Impact A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This results in an incorrect shared secret value being returned when the decapsulation function is called with a malformed ciphertext. No concrete attack exploiting the error has been identified at this point. However, the error involves mishandling of the secret key, and in principle this presents a security vulnerability. Patches PQClean does not have a release process, as it is a collection of implementations. If you obtained a HQC implementation from PQClean, please update to a version that includes the fixes proposed in https://github.com/PQClean/PQClean/pull/578. Please also refer to our security policy. Workarounds Manually patching is always possible Further details In the 2023/04/30 version of the HQC specification and reference implementation, an extra field (sigma)…

    Recommended action: Upgrade to 0.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →