crystals-go vulnerable to KyberSlash (timing side-channel attack for Kyber)
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key. ### Patches Patched in https://github.com/kudelskisecurity/crystals-go/pull/21 ### Note This library was written as part of a MsC student project in the Cybersecurity Team at Kudelski Security. It is not actively maintained anymore. It is only intended for research and testing. We discourage its use in any production environment. Kudelski Security does not use this library as part of their commercial offers or product. This has now been clarified on the project's README. ### References https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/ldX0ThYJuBo http://kyberslash.cr.yp.to/
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/kudelskisecurity/crystals-go (Go) | before 0.0.0-20240116172146-2a6ca2d4e64d | 0.0.0-20240116172146-2a6ca2d4e64d | Patch available | GHSA-f6jh-hvg2-9525 |
- github.com/kudelskisecurity/crystals-go (Go) Vendor— Affected before 0.0.0-20240116172146-2a6ca2d4e64d Fixed in 0.0.0-20240116172146-2a6ca2d4e64d Patch available GHSA-f6jh-hvg2-9525
Remediation
- Fix · GHSA-f6jh-hvg2-9525 github.com/kudelskisecurity/crystals-go (Go) Fixed in 0.0.0-20240116172146-2a6ca2d4e64d Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-f6jh-hvg2-9525
References
Other 7
- https://github.com/kudelskisecurity/crystals-go/security/advisories/GHSA-f6jh-hvg2-9525
- https://github.com/kudelskisecurity/crystals-go/issues/19
- https://github.com/kudelskisecurity/crystals-go/pull/20
- https://github.com/kudelskisecurity/crystals-go/pull/21
- https://github.com/kudelskisecurity/crystals-go/commit/2a6ca2d4e64d18dd6e8fbb4e48e22c2510118505
- https://github.com/kudelskisecurity/crystals-go
- https://kyberslash.cr.yp.to/faq
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences