Description

An incorrect constant for the key length in libcrux-poly1305 caused the standalone MAC function `libcrux_poly1305::mac` to always panic with an out-of-bounds memory access. ## Impact Applications wishing to use libcrux-poly1305 as a standalone MAC would experience panics. The use of libcrux-poly1305 in libcrux-chacha20poly1305 is unaffected. ## Mitigation Starting from version `0.0.5`, the correct value is used for the key length constant.

Description source: GitHub Advisory

Affected products and versions

1
ProductSourceVersion rangeStatus
GitHub AdvisoryBefore 0.0.5 · Fixed in 0.0.5affected

References

3