Reported

February 25, 2022

Issued

August 11, 2022

Package

oqs (crates.io)

Type

Vulnerability

Categories

• crypto-failure

Details

https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/KFgw5_qCXiI?pli=1

Patched

• >=0.7.2

Description

Ward Beullens found a practical key-recovery attack against Rainbow. The level I parametersets are removed from liboqs starting from version 0.7.2. Find the scientific details in Breaking Rainbow Takes a Weekend on a Laptop.

This means all the oqs::sig::Algorithm::RainbowI* variants are insecure.