rpgp / rpgp

Crate pgp

Dependencies

(58 total, 2 outdated, 1 insecure, 1 possibly insecure)

Crate	Required	Latest	Status
aes	`^0.8`	`0.8.4`	up to date
argon2	`^0.5`	`0.5.3`	up to date
base64	`^0.22.0`	`0.22.1`	up to date
bitfield	`^0.14`	`0.15.0`	out of date
block-padding	`^0.3.2`	`0.3.3`	up to date
blowfish	`^0.9`	`0.9.1`	up to date
byteorder	`^1.4`	`1.5.0`	up to date
camellia	`^0.1`	`0.1.0`	up to date
chrono	`^0.4.23`	`0.4.38`	up to date
cast5	`^0.11.0`	`0.11.1`	up to date
cfb-mode	`^0.8.1`	`0.8.2`	up to date
cipher	`^0.4`	`0.4.4`	up to date
const-oid	`^0.9`	`0.9.6`	up to date
crc24	`^0.1`	`0.1.6`	up to date
derive_builder	`^0.20.0`	`0.20.0`	up to date
des	`^0.8`	`0.8.1`	up to date
digest	`^0.10`	`0.10.7`	up to date
dsa	`^0.6.3`	`0.6.3`	up to date
ecdsa	`^0.16`	`0.16.9`	up to date
elliptic-curve	`^0.13`	`0.13.8`	up to date
generic-array	`^0.14`	`1.0.0`	out of date
hex	`^0.4`	`0.4.3`	up to date
idea	`^0.5`	`0.5.1`	up to date
iter-read	`^1`	`1.0.1`	up to date
log	`^0.4.6`	`0.4.21`	up to date
md-5	`^0.10.5`	`0.10.6`	up to date
nom	`^7.0`	`7.1.3`	up to date
num_enum	`^0.7`	`0.7.2`	up to date
num-traits	`^0.2.6`	`0.2.19`	up to date
p256	`^0.13`	`0.13.2`	up to date
p384	`^0.13`	`0.13.0`	up to date
p521	`^0.13`	`0.13.3`	up to date
k256	`^0.13`	`0.13.3`	up to date
rand	`^0.8`	`0.8.5`	up to date
ripemd	`^0.1.3`	`0.1.3`	up to date
rsa ⚠️	`^0.9.0`	`0.9.6`	insecure
sha1	`^0.10.5`	`0.10.6`	up to date
sha1-checked	`^0.10`	`0.10.0`	up to date
sha2	`^0.10.6`	`0.10.8`	up to date
sha3	`^0.10.5`	`0.10.8`	up to date
signature	`^2.0.0`	`2.2.0`	up to date
smallvec	`^1.8.0`	`1.13.2`	up to date
thiserror	`^1.0.30`	`1.0.61`	up to date
twofish	`^0.7`	`0.7.1`	up to date
zeroize	`^1.5`	`1.8.1`	up to date
getrandom	`^0.2`	`0.2.15`	up to date
bstr	`^1.4.0`	`1.9.1`	up to date
hkdf	`^0.12.4`	`0.12.4`	up to date
aes-gcm	`^0.10.3`	`0.10.3`	up to date
eax	`^0.5.0`	`0.5.0`	up to date
ocb3	`^0.1`	`0.1.0`	up to date
buffer-redux	`^1.0.0`	`1.0.1`	up to date
curve25519-dalek ⚠️	`^4.1.2`	`4.1.3`	maybe insecure
ed25519-dalek	`^2.0.0`	`2.1.1`	up to date
flate2	`^1.0`	`1.0.30`	up to date
gperftools	`^0.2.0`	`0.2.0`	up to date
num-bigint-dig	`^0.8.1`	`0.8.4`	up to date
x25519-dalek	`^2.0.1`	`2.0.1`	up to date

Crate

Required

Latest

Status

aes

^0.8

0.8.4

up to date

argon2

^0.5

0.5.3

up to date

base64

^0.22.0

0.22.1

up to date

bitfield

^0.14

0.15.0

out of date

block-padding

^0.3.2

0.3.3

up to date

blowfish

^0.9

0.9.1

up to date

byteorder

^1.4

1.5.0

up to date

camellia

^0.1

0.1.0

up to date

chrono

^0.4.23

0.4.38

up to date

cast5

^0.11.0

0.11.1

up to date

cfb-mode

^0.8.1

0.8.2

up to date

cipher

^0.4

0.4.4

up to date

const-oid

^0.9

0.9.6

up to date

crc24

^0.1

0.1.6

up to date

derive_builder

^0.20.0

0.20.0

up to date

des

^0.8

0.8.1

up to date

digest

^0.10

0.10.7

up to date

dsa

^0.6.3

0.6.3

up to date

ecdsa

^0.16

0.16.9

up to date

elliptic-curve

^0.13

0.13.8

up to date

generic-array

^0.14

1.0.0

out of date

hex

^0.4

0.4.3

up to date

idea

^0.5

0.5.1

up to date

iter-read

^1

1.0.1

up to date

log

^0.4.6

0.4.21

up to date

md-5

^0.10.5

0.10.6

up to date

nom

^7.0

7.1.3

up to date

num_enum

^0.7

0.7.2

up to date

num-traits

^0.2.6

0.2.19

up to date

p256

^0.13

0.13.2

up to date

p384

^0.13

0.13.0

up to date

p521

^0.13

0.13.3

up to date

k256

^0.13

0.13.3

up to date

rand

^0.8

0.8.5

up to date

ripemd

^0.1.3

0.1.3

up to date

rsa ⚠️

^0.9.0

0.9.6

insecure

sha1

^0.10.5

0.10.6

up to date

sha1-checked

^0.10

0.10.0

up to date

sha2

^0.10.6

0.10.8

up to date

sha3

^0.10.5

0.10.8

up to date

signature

^2.0.0

2.2.0

up to date

smallvec

^1.8.0

1.13.2

up to date

thiserror

^1.0.30

1.0.61

up to date

twofish

^0.7

0.7.1

up to date

zeroize

^1.5

1.8.1

up to date

getrandom

^0.2

0.2.15

up to date

bstr

^1.4.0

1.9.1

up to date

hkdf

^0.12.4

0.12.4

up to date

aes-gcm

^0.10.3

0.10.3

up to date

eax

^0.5.0

0.5.0

up to date

ocb3

^0.1

0.1.0

up to date

buffer-redux

^1.0.0

1.0.1

up to date

curve25519-dalek ⚠️

^4.1.2

4.1.3

maybe insecure

ed25519-dalek

^2.0.0

2.1.1

up to date

flate2

^1.0

1.0.30

up to date

gperftools

^0.2.0

0.2.0

up to date

num-bigint-dig

^0.8.1

0.8.4

up to date

x25519-dalek

^2.0.1

2.0.1

up to date

Dev dependencies

(10 total, all up-to-date)

Crate	Required	Latest	Status
glob	`^0.3`	`0.3.1`	up to date
hex-literal	`^0.4`	`0.4.1`	up to date
pretty_assertions	`^1`	`1.4.0`	up to date
pretty_env_logger	`^0.5`	`0.5.0`	up to date
rand_chacha	`^0.3`	`0.3.1`	up to date
rand_xorshift	`^0.3`	`0.3.0`	up to date
regex	`^1.7`	`1.10.5`	up to date
serde	`^1.0`	`1.0.203`	up to date
serde_json	`^1.0`	`1.0.118`	up to date
criterion	`^0.5`	`0.5.1`	up to date

Crate

Required

Latest

Status

glob

^0.3

0.3.1

up to date

hex-literal

^0.4

0.4.1

up to date

pretty_assertions

^1

1.4.0

up to date

pretty_env_logger

^0.5

0.5.0

up to date

rand_chacha

^0.3

0.3.1

up to date

rand_xorshift

^0.3

0.3.0

up to date

regex

^1.7

1.10.5

up to date

serde

^1.0

1.0.203

up to date

serde_json

^1.0

1.0.118

up to date

criterion

^0.5

0.5.1

up to date

Security Vulnerabilities

`rsa`: Marvin Attack: potential key recovery through timing sidechannels

RUSTSEC-2023-0071

Impact

Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key.

Patches

No patch is yet available, however work is underway to migrate to a fully constant-time implementation.

Workarounds

The only currently available workaround is to avoid using the rsa crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer is fine.

References

This vulnerability was discovered as part of the "Marvin Attack", which revealed several implementations of RSA including OpenSSL had not properly mitigated timing sidechannel attacks.

`curve25519-dalek`: Timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`

RUSTSEC-2024-0344

Timing variability of any kind is problematic when working with potentially secret values such as elliptic curve scalars, and such issues can potentially leak private keys and other secrets. Such a problem was recently discovered in curve25519-dalek.

The Scalar29::sub (32-bit) and Scalar52::sub (64-bit) functions contained usage of a mask value inside a loop where LLVM saw an opportunity to insert a branch instruction (jns on x86) to conditionally bypass this code section when the mask value is set to zero as can be seen in godbolt:

32-bit (see L106): https://godbolt.org/z/zvaWxzvqv
64-bit (see L48): https://godbolt.org/z/PczYj7Pda

A similar problem was recently discovered in the Kyber reference implementation:

https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/hqbtIGFKIpU/m/cnE3pbueBgAJ

As discussed on that thread, one portable solution, which is also used in this PR, is to introduce a volatile read as an optimization barrier, which prevents the compiler from optimizing it away.

The fix can be validated in godbolt here:

32-bit: https://godbolt.org/z/jc9j7eb8E
64-bit: https://godbolt.org/z/x8d46Yfah

The problem was discovered and the solution independently verified by Alexander Wagner [email protected] and Lea Themint [email protected] using their DATA tool:

https://github.com/Fraunhofer-AISEC/DATA

Crate pgp

Dependencies

Dev dependencies

Security Vulnerabilities

rsa: Marvin Attack: potential key recovery through timing sidechannels

Impact

Patches

Workarounds

References

curve25519-dalek: Timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`

Crate `pgp`

`rsa`: Marvin Attack: potential key recovery through timing sidechannels

`curve25519-dalek`: Timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`