pgp 0.10.2

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate `pgp`

Dependencies

(46 total, 8 outdated, 1 insecure, 2 possibly insecure)

Crate	Required	Latest	Status
aes	`^0.8`	`0.8.4`	up to date
base64	`^0.21.0`	`0.22.1`	out of date
bitfield	`^0.14`	`0.18.0`	out of date
block-padding	`^0.3.2`	`0.3.3`	up to date
blowfish	`^0.9`	`0.9.1`	up to date
bstr	`^1.4.0`	`1.11.3`	up to date
buffer-redux	`^1.0.0`	`1.0.2`	up to date
byteorder	`^1.4`	`1.5.0`	up to date
camellia	`^0.1`	`0.1.0`	up to date
cast5	`^0.11.0`	`0.11.1`	up to date
cfb-mode	`^0.8.1`	`0.8.2`	up to date
chrono	`^0.4.23`	`0.4.39`	up to date
cipher	`^0.4`	`0.4.4`	up to date
crc24	`^0.1`	`0.1.6`	up to date
curve25519-dalek ⚠️	`^4.0.0-rc.3`	`4.1.3`	maybe insecure
derive_builder	`^0.12.0`	`0.20.2`	out of date
des	`^0.8`	`0.8.1`	up to date
digest	`^0.10`	`0.10.7`	up to date
ed25519-dalek ⚠️	`^2.0.0-rc.3`	`2.1.1`	maybe insecure
elliptic-curve	`^0.13`	`0.13.8`	up to date
flate2	`^1.0`	`1.0.35`	up to date
generic-array	`^0.14`	`1.2.0`	out of date
getrandom	`^0.2.6`	`0.3.1`	out of date
gperftools	`^0.2.0`	`0.2.0`	up to date
hex	`^0.4`	`0.4.3`	up to date
idea	`^0.5`	`0.5.1`	up to date
log	`^0.4.6`	`0.4.25`	up to date
md-5	`^0.10.5`	`0.10.6`	up to date
nom	`^7.0`	`8.0.0`	out of date
num-bigint-dig	`^0.8.1`	`0.8.4`	up to date
num-derive	`^0.4.0`	`0.4.2`	up to date
num-traits	`^0.2.6`	`0.2.19`	up to date
p256	`^0.13`	`0.13.2`	up to date
p384	`^0.13`	`0.13.0`	up to date
rand	`^0.8`	`0.9.0`	out of date
ripemd	`^0.1.3`	`0.1.3`	up to date
rsa ⚠️	`^0.9.0`	`0.9.7`	insecure
sha1	`^0.10.5`	`0.10.6`	up to date
sha2	`^0.10.6`	`0.10.8`	up to date
sha3	`^0.10.5`	`0.10.8`	up to date
signature	`^2.0.0`	`2.2.0`	up to date
smallvec	`^1.8.0`	`1.13.2`	up to date
thiserror	`^1.0.30`	`2.0.11`	out of date
twofish	`^0.7`	`0.7.1`	up to date
x25519-dalek	`^2.0.0-rc.3`	`2.0.1`	up to date
zeroize	`^1.5`	`1.8.1`	up to date

Dev dependencies

(9 total, 4 outdated)

Crate	Required	Latest	Status
glob	`^0.3`	`0.3.2`	up to date
hex-literal	`^0.3`	`0.4.1`	out of date
pretty_assertions	`^1`	`1.4.1`	up to date
pretty_env_logger	`^0.4`	`0.5.0`	out of date
rand_chacha	`^0.3`	`0.9.0`	out of date
rand_xorshift	`^0.3`	`0.4.0`	out of date
regex	`^1.7`	`1.11.1`	up to date
serde	`^1.0`	`1.0.217`	up to date
serde_json	`^1.0`	`1.0.138`	up to date

Security Vulnerabilities

`ed25519-dalek`: Double Public Key Signing Function Oracle Attack on `ed25519-dalek`

RUSTSEC-2022-0093

Versions of ed25519-dalek prior to v2.0 model private and public keys as separate types which can be assembled into a Keypair, and also provide APIs for serializing and deserializing 64-byte private/public keypairs.

Such APIs and serializations are inherently unsafe as the public key is one of the inputs used in the deterministic computation of the S part of the signature, but not in the R value. An adversary could somehow use the signing function as an oracle that allows arbitrary public keys as input can obtain two signatures for the same message sharing the same R and only differ on the S part.

Unfortunately, when this happens, one can easily extract the private key.

Revised public APIs in v2.0 of ed25519-dalek do NOT allow a decoupled private/public keypair as signing input, except as part of specially labeled "hazmat" APIs which are clearly labeled as being dangerous if misused.

`rsa`: Marvin Attack: potential key recovery through timing sidechannels

RUSTSEC-2023-0071

Impact

Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key.

Patches

No patch is yet available, however work is underway to migrate to a fully constant-time implementation.

Workarounds

The only currently available workaround is to avoid using the rsa crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer is fine.

References

This vulnerability was discovered as part of the "Marvin Attack", which revealed several implementations of RSA including OpenSSL had not properly mitigated timing sidechannel attacks.

`curve25519-dalek`: Timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`

RUSTSEC-2024-0344

Timing variability of any kind is problematic when working with potentially secret values such as elliptic curve scalars, and such issues can potentially leak private keys and other secrets. Such a problem was recently discovered in curve25519-dalek.

The Scalar29::sub (32-bit) and Scalar52::sub (64-bit) functions contained usage of a mask value inside a loop where LLVM saw an opportunity to insert a branch instruction (jns on x86) to conditionally bypass this code section when the mask value is set to zero as can be seen in godbolt:

32-bit (see L106): https://godbolt.org/z/zvaWxzvqv
64-bit (see L48): https://godbolt.org/z/PczYj7Pda

A similar problem was recently discovered in the Kyber reference implementation:

https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/hqbtIGFKIpU/m/cnE3pbueBgAJ

As discussed on that thread, one portable solution, which is also used in this PR, is to introduce a volatile read as an optimization barrier, which prevents the compiler from optimizing it away.

The fix can be validated in godbolt here:

32-bit: https://godbolt.org/z/jc9j7eb8E
64-bit: https://godbolt.org/z/x8d46Yfah

The problem was discovered and the solution independently verified by Alexander Wagner [email protected] and Lea Themint [email protected] using their DATA tool:

https://github.com/Fraunhofer-AISEC/DATA

Crate pgp