search

RustCrypto / hashes

Collection of cryptographic hash functions written in pure Rust
1.9k stars 256 forks source link

ring affected by CVE-2022-37454? #456

Closed dns2utf8 closed 1 year ago

dns2utf8 commented 1 year ago

Hi all

I did not have time to look into this, but are we affected too?

A Vulnerability in Implementations of SHA-3, SHAKE, EdDSA, and Other NIST-Approved Algorithms https://eprint.iacr.org/2023/331.pdf

newpavlov commented 1 year ago

As far as I understand the issue, no, our code (i.e. the sha3 crate) should not be affected. We do block splitting generically using the block-buffer crate without any casting shenanigans between 32 and 64 bit integers.

As for ring, it's better to ask in the ring repo, not here, as it's not part of the RustCrypto project.

dns2utf8 commented 1 year ago

That are good points, thank you! Could we add the test vectors they found just to be safe?

newpavlov commented 1 year ago

To trigger the issue on affected code you need to hash 4GiB+. It's too much for integration tests which we run in our CI.