Description

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating an AEADError. These were fixed in the respective patched releases.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T14:17:52.797Z",
  "pubdate": "2026-08-19T14:17:52.797Z",
  "executiveSummary": "Multiple cryptographic implementation vulnerabilities have been identified across libcrux-ecdh, libcrux-ed25519, and libcrux-psq libraries. These flaws involve improper length validation and faulty clamping checks during X25519 secret key validation in libcrux-ecdh, a redundant and duplicated clamping step during key generation within libcrux-ed25519, and improper error handling in libcrux-psq where an unexpected panic is triggered instead of propagating an AEADError.\nThe impact of these flaws includes potential cryptographic key validation failures, operational disruptions via denial of service due to unhandled panics, and potential deviations from expected cryptographic security guarantees. The affected products include libcrux-ecdh before 0.0.6, libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7.\nAttackers capable of supplying malformed cryptographic inputs, invalid key lengths, or triggering decryption operations that fail AEAD checks may induce application panics or exploit weaknesses in secret key validation routines. Remediation requires updating the affected libraries to their respective patched release versions where these implementation bugs have been corrected.",
  "technicalDetails": "The vulnerabilities stem from distinct cryptographic and implementation logic errors within the libcrux ecosystem. The root cause in libcrux-ecdh involves improper length validation and an inadequate clamping check when validating X25519 secrets, alongside a broken clamping verification mechanism specifically affecting imported X25519 secret keys. Clamping is a crucial step in Curve25519/X25519 operations that clears specific bits to prevent small-subgroup attacks and ensure uniform scalar multiplication. Because libcrux-ecdh failed to enforce correct length checks and properly clamp imported keys, processed keys may bypass intended cryptographic constraints.\nIn libcrux-ed25519, the vulnerability manifests as a duplicated clamping step executed during the key generation phase. While applying clamping is necessary for Ed25519 scalar generation, performing the step redundantly introduces potential performance anomalies or deviation from standard implementation patterns, increasing code complexity and surface area for logic flaws.\nIn libcrux-psq, the flaw relates to improper error handling during authenticated encryption with associated data (AEAD) operations. When an AEAD decryption or verification failure occurs, the library triggers a runtime panic rather than gracefully propagating an AEADError up the call stack. This behavior allows malicious actors or malformed payloads to force an unhandled exception, causing denial of service conditions in dependent applications.\nExploitation of these vulnerabilities typically occurs when a dependent system processes maliciously crafted inputs, such as improperly formatted X25519 keys, or triggers cryptographic decryption failures that exploit the unhandled panic condition in libcrux-psq. The vulnerable components are the core cryptographic routines within libcrux-ecdh, libcrux-ed25519, and libcrux-psq. Affected versions encompass libcrux-ecdh and libcrux-ed25519 prior to release 0.0.6, and libcrux-psq prior to release 0.0.7."
}