GHSA-hrjv-pf36-jpmr: oqs's Post-Quantum Key Encapsulation Mechanism SIKE broken

August 18, 2022

Wouter Castryck and Thomas Decru presented an efficient key recovery attack on the SIDH protocol. As a result, the secret key of SIKEp751 can be recovered in a matter of hours. The SIKE and SIDH schemes will be removed from oqs 0.7.2.

An efficient key recovery attack on SIDH (preliminary version)

References

github.com/advisories/GHSA-hrjv-pf36-jpmr
github.com/open-quantum-safe/liboqs-rust
github.com/open-quantum-safe/liboqs-rust/pull/151
rustsec.org/advisories/RUSTSEC-2022-0045.html

Code Behaviors & Features

Detect and mitigate GHSA-hrjv-pf36-jpmr with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →