sntrup761: implicit-rejection key differs from the specification since 4e963e91
Testing, NormalPublic
Actions

Assigned To

None

Authored By

	jukivili
	Fri, Nov 6, 6:56 AM

Description

Reported on gcrypt-devel mailinglist by Bhabani Sankar Das:

libgcrypt's sntrup761 decapsulation returns a different rejection key
from the specification since a constant-time refactor in 2025. I found
no attack (reasoning below), so I am reporting it here as a normal bug
with a one-line fix.

https://lists.gnupg.org/pipermail/gcrypt-devel/2026-November/006274.html

Details

Version: 1.11.3, 1.12.4, master

Revisions and Commits

rC libgcrypt
	rC88563e87675c tests/t-sntrup761: add checksum test from libntruprime
	rCdb693344a8be sntrup761: fix implicit rejection key in decapsulation

Related Objects

Mentioned Here: rC4e963e91dbe5: sntrup761: use const-time helpers for memory comparison and cond move
rC7ff58b28726e: sntrup761: use const-time helpers for memory comparison and cond move
rC53742c7e60f5: camellia-gfni-avx512: speed up 1-block implementation

Event Timeline

jukivili created this task.Fri, Nov 6, 6:56 AM

jukivili updated the task description. (Show Details)Sat, Nov 7, 4:59 AM

jukivili added a commit: rCdb693344a8be: sntrup761: fix implicit rejection key in decapsulation.Sat, Nov 7, 5:17 PM

jukivili added a commit: rC88563e87675c: tests/t-sntrup761: add checksum test from libntruprime.

• gniibe changed the task status from Open to Testing.Tue, Nov 10, 2:05 AM

• gniibe triaged this task as Normal priority.