CVE-2026-22705
RustCrypto: Signatures has timing side-channel in ML-DSA decomposition
Résumé
RustCrypto: Signatures has timing side-channel in ML-DSA decomposition
Description d'origine
La description telle que publiée par la source (souvent en anglais).
RustCrypto: Signatures offers support for digital signatures, which provide authentication of data using public-key cryptography. Prior to version 0.1.0-rc.2, a timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature. This issue has been patched in version 0.1.0-rc.2.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
crates.io
ml-dsa
[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.1.0-rc.3"}]}]
Références
- advisory rustsec.org
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- package crates.io
- patch github.com
- patch github.com