Reported

August 9, 2026

Issued

August 9, 2026

Package

dcrypt-algorithms (crates.io)

Type

Vulnerability

Categories

• crypto-failure

Keywords

#aes-gcm #nonce-reuse

Aliases

• GHSA-h9f2-fgp8-vc4h

References

• https://github.com/ioi-foundation/dcrypt/security/advisories/GHSA-h9f2-fgp8-vc4h
• https://github.com/ioi-foundation/dcrypt/commit/c99cc86f0ee353010cd202cbcd2c310371b0bbb8
• https://github.com/ioi-foundation/dcrypt/releases/tag/v2.0.0

Patched

• >=2.0.0

Description

In all published versions of dcrypt-algorithms before 2.0.0, the low-level Gcm builder required an operation nonce but derived J0 from the nonce captured by the original Gcm constructor. Multiple operations could therefore silently reuse a nonce even when callers supplied distinct values, compromising confidentiality and authenticity under an affected key.

Version 2.0.0 makes Gcm key-only and passes the operation nonce through IV derivation, encryption, and decryption. It also corrects non-96-bit IV processing, rejects tags shorter than 96 bits, and enforces counter limits. Applications must upgrade, identify affected keys, rotate them, and re-encrypt affected data; updating the implementation cannot restore security after nonce reuse.

Advisory available under CC0-1.0 license.