GHSA-g433-pq76-6cmf

We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:

hpke-rs

• #127: Fix KemAlgorithm::TryFrom<u16> mapping where 0x004D incorrectly resolved to XWingDraft06 instead of XWingDraft06Obsolete.
• #123: Fix potential overflow in context counter and switch to use u64.
• #128: Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it)

The issue fixed in #123 was first reported by Nadim Kobeissi. The issues fixed in #127 and #128 were first reported by Scott Arciszewski.

hpke-rs-rust-crypto

• #124: Error out on x25519 0 keys

The issue fixed in #124 was first reported by Nadim Kobeissi.

We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:

hpke-rs

• #127: Fix KemAlgorithm::TryFrom<u16> mapping where 0x004D incorrectly resolved to XWingDraft06 instead of XWingDraft06Obsolete.
• #123: Fix potential overflow in context counter and switch to use u64.
• #128: Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it)

The issue fixed in #123 was first reported by Nadim Kobeissi. The issues fixed in #127 and #128 were first reported by Scott Arciszewski.

hpke-rs-rust-crypto

• #124: Error out on x25519 0 keys

The issue fixed in #124 was first reported by Nadim Kobeissi.

Constructing an HPKE Context with the AEAD algorithm set to HpkeExport resulted in a panic when calling Context::seal, or Context::open. This was due to an underflowing integer subtraction when calculating the length of a vector allocation for the AEAD nonce, which would panic on its own in debug mode and cause out-of-memory abort on the allocation in release mode.

Impact

Applications that could be made to use an HPKE context configured with HpkeExport as AEAD algorithm to open or seal a ciphertext would crash. Other applications are unaffected.

Mitigation

Starting with version 0.6.0, an error will be returned when attempting to call Context::seal or Context::open on an HPKE context with HpkeExport as AEADAlgorithm.

The sequence number that is used to compute the AEAD nonce when using a re-usable HPKE context is incremented after each seal or open operation. This sequence number was stored as a u32 and used regular addition on u32 for the increment, meaning in release mode it would silently wrap around to 0 after 2^32 seal or open operations.

Impact

Nonce reuse causes catastrophic breakage of AEAD ciphers, enabling plaintext recovery attacks and authentication tag forgeries, depending on the concrete AEAD.

This bug impacts applications that use hpke-rs to encrypt a large number of messages using the same context. Applications using the one-shot APIs are unaffected.

Mitigation

Starting with version 0.6.0, checked_add is used to increment the sequence number, which avoids a silent wraparound in release mode. Additionally, the sequence number is now stored as a u64, increasing the maximally allowed number of seal and open operations on a given HPKE context.

Passing values length > 65535 to Context::export produces output that disagrees with the RFC 9180 label encoding. In particular the length value is cast to u16 truncating any value exceeding 65535.

Impact

Applications that use hpke-rs to export very large secrets would experience interoperability issues with other applications that use a correct implementation to export very large secrets.

Mitigation

Starting with version 0.6.0, an error will be returned when attempting to call Context::export with an output length > 65535.

Computing an X25519 shared secret with x25519_dalek::StaticSecret::diffie_hellman does not include the check that the key exchange was contributory, i.e. does not ensure on its own that the resulting shared secret is non-zero.

Impact

RFC 9180 mandates that implementations of HPKE must check for all zero Diffie-Hellman shared secrets and abort if so.

Applications using hpke-rs with the RustCryto provider would not perform this check allowing for non-contributive Diffie-Hellman shared secrets. Applications using hpke-rs with the libcrux provider are not affected.

Mitigation

Starting with version 0.6.0, an error will be returned when the computed Diffie-Hellman shared secret is all-zero.