OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-02-23 15:38:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add advisory for broken blake2 impls

Browse Source 
BLAKE2b and BLAKE2s were implemented using the wrong block size. All
versions of the `blake2` crate prior to v0.8.1 compute incorrect
digests.

See: https://github.com/RustCrypto/MACs/issues/19
This commit is contained in:
Tony Arcieri
2019-09-06 08:30:08 -07:00
parent 21a1767752
commit 6d0db7286e
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
crates/blake2/RUSTSEC-0000-0000.toml Normal file
View File

@@ -0,0 +1,20 @@
[advisory]
id = "RUSTSEC-0000-0000"
package = "blake2"
date = "2019-08-25"
title = "HMAC-BLAKE2 algorithms compute incorrect results"
description = """
When used in conjunction with the Hash-based Message Authentication Code (HMAC),
the BLAKE2b and BLAKE2s implementations in `blake2` crate versions prior to
v0.8.1 used an incorrect block size (32-bytes instead of 64-bytes for BLAKE2s,
and 64-bytes instead of 128-bytes for BLAKE2b), causing them to miscompute the
`MacResult`.
The v0.8.1 release of the `blake2` crate uses the correct block sizes.
Note that this advisory only impacts usage of BLAKE2 with HMAC, and does not
impact `Digest` functionality.
"""
patched_versions = [">= 0.8.1"]
url = "https://github.com/RustCrypto/MACs/issues/19"
category = ["crypto-failure"]