Description
The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform-s implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating party could fail to detect a manipulated ciphertext and proceed without the standard-s required implicit rejection.
CVSS 6.5EPSS 0.135%Risque 0.66
Voir la source- Publication
- 2026-06-25 22:17:02
- Versions concernées
- unknown
- Type
- Bibliothèque
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N