iqlusioninc / yubihsm.rs

Crate yubihsm

Dependencies

(31 total, 1 outdated, 1 insecure)

Crate	Required	Latest	Status
aes	`^0.8`	`0.8.4`	up to date
bitflags	`^2`	`2.6.0`	up to date
cmac	`^0.7`	`0.7.2`	up to date
cbc	`^0.1`	`0.1.2`	up to date
ccm	`^0.5`	`0.5.0`	up to date
digest	`^0.10`	`0.10.7`	up to date
ecdsa	`^0.16`	`0.16.9`	up to date
ed25519	`^2`	`2.2.3`	up to date
log	`^0.4`	`0.4.22`	up to date
num-traits	`^0.2`	`0.2.19`	up to date
p256	`^0.13`	`0.13.2`	up to date
p384	`^0.13`	`0.13.0`	up to date
serde	`^1`	`1.0.214`	up to date
rand_core	`^0.6`	`0.6.4`	up to date
rsa ⚠️	`^0.9.6`	`0.9.6`	insecure
signature	`^2`	`2.2.0`	up to date
sha1	`^0.10`	`0.10.6`	up to date
sha2	`^0.10`	`0.10.8`	up to date
spki	`^0.7.3`	`0.7.3`	up to date
subtle	`^2`	`2.6.1`	up to date
thiserror	`^1`	`2.0.0`	out of date
time	`^0.3`	`0.3.36`	up to date
uuid	`^1`	`1.11.0`	up to date
zeroize	`^1`	`1.8.1`	up to date
ed25519-dalek	`^2`	`2.1.1`	up to date
hmac	`^0.12`	`0.12.1`	up to date
k256	`^0.13`	`0.13.4`	up to date
pbkdf2	`^0.12`	`0.12.2`	up to date
serde_json	`^1`	`1.0.132`	up to date
rusb	`^0.9.4`	`0.9.4`	up to date
tiny_http	`^0.12`	`0.12.0`	up to date

Crate

Required

Latest

Status

aes

^0.8

0.8.4

up to date

bitflags

^2

2.6.0

up to date

cmac

^0.7

0.7.2

up to date

cbc

^0.1

0.1.2

up to date

ccm

^0.5

0.5.0

up to date

digest

^0.10

0.10.7

up to date

ecdsa

^0.16

0.16.9

up to date

ed25519

^2

2.2.3

up to date

log

^0.4

0.4.22

up to date

num-traits

^0.2

0.2.19

up to date

p256

^0.13

0.13.2

up to date

p384

^0.13

0.13.0

up to date

serde

^1

1.0.214

up to date

rand_core

^0.6

0.6.4

up to date

rsa ⚠️

^0.9.6

0.9.6

insecure

signature

^2

2.2.0

up to date

sha1

^0.10

0.10.6

up to date

sha2

^0.10

0.10.8

up to date

spki

^0.7.3

0.7.3

up to date

subtle

^2

2.6.1

up to date

thiserror

^1

2.0.0

out of date

time

^0.3

0.3.36

up to date

uuid

^1

1.11.0

up to date

zeroize

^1

1.8.1

up to date

ed25519-dalek

^2

2.1.1

up to date

hmac

^0.12

0.12.1

up to date

k256

^0.13

0.13.4

up to date

pbkdf2

^0.12

0.12.2

up to date

serde_json

^1

1.0.132

up to date

rusb

^0.9.4

0.9.4

up to date

tiny_http

^0.12

0.12.0

up to date

Dev dependencies

(5 total, 1 insecure)

Crate	Required	Latest	Status
ed25519-dalek	`^2`	`2.1.1`	up to date
once_cell	`^1`	`1.20.2`	up to date
rsa ⚠️	`^0.9.6`	`0.9.6`	insecure
p256	`^0.13`	`0.13.2`	up to date
x509-cert	`^0.2.5`	`0.2.5`	up to date

Crate

Required

Latest

Status

ed25519-dalek

^2

2.1.1

up to date

once_cell

^1

1.20.2

up to date

rsa ⚠️

^0.9.6

0.9.6

insecure

p256

^0.13

0.13.2

up to date

x509-cert

^0.2.5

0.2.5

up to date

Security Vulnerabilities

`rsa`: Marvin Attack: potential key recovery through timing sidechannels

RUSTSEC-2023-0071

Impact

Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key.

Patches

No patch is yet available, however work is underway to migrate to a fully constant-time implementation.

Workarounds

The only currently available workaround is to avoid using the rsa crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer is fine.

References

This vulnerability was discovered as part of the "Marvin Attack", which revealed several implementations of RSA including OpenSSL had not properly mitigated timing sidechannel attacks.

Deps.rs

iqlusioninc / yubihsm.rs

Crate `yubihsm`

Dependencies

Dev dependencies

Security Vulnerabilities

`rsa`: Marvin Attack: potential key recovery through timing sidechannels

Impact

Patches

Workarounds

References

iqlusioninc / yubihsm.rs

Crate yubihsm

Dependencies

Dev dependencies

Security Vulnerabilities

rsa: Marvin Attack: potential key recovery through timing sidechannels

Impact

Patches

Workarounds

References

Crate `yubihsm`

`rsa`: Marvin Attack: potential key recovery through timing sidechannels