rustsec-2026-0211
Vulnerability from osv_rustsec
Published
2026-07-14 12:00
Modified
2026-07-17 11:34
Summary
Non-constant time Authentication Tag Check in AES-GCM Decryption
Details

AES-GCM decryption used an implementation for checking the provided authentication tag against the recomputed authentication tag that was intended to be constant-time, but resulted in non-constant-time code generation in certain circumstances. Note that libcrux-aesgcm does not give guarantees on constant-time code generation and possible mitigations must be considered on a best-effort basis.

Impact

Users of libcrux-aesgcm that expose a decryption oracle to an attacker, which allows repeatedly querying for the same ciphertext were at risk from timing side-channel attacks, depending on their compilation environment. In the worst case, this could lead to recovery of the recomputed authentication tag by the attacker, which enables ciphertext forgery.

Mitigation

Starting from version 0.0.9 (published as libcrux-aes@v0.0.9), AES-GCM decryption uses a different, best-effort constant-time implementation of the tag check, which has been checked to reliably lead to constant time code generation, at the moment.

Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "crypto-failure"
        ],
        "cvss": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "libcrux_aesgcm::AesGcm128Key::decrypt",
            "libcrux_aesgcm::AesGcm256Key::decrypt",
            "libcrux_aesgcm::aes_gcm_128::AesGcm128::decrypt",
            "libcrux_aesgcm::aes_gcm_128::Key::decrypt",
            "libcrux_aesgcm::aes_gcm_128::KeyRef::decrypt",
            "libcrux_aesgcm::aes_gcm_128::neon::Key::decrypt",
            "libcrux_aesgcm::aes_gcm_128::neon::KeyRef::decrypt",
            "libcrux_aesgcm::aes_gcm_128::neon::NeonAesGcm128::decrypt",
            "libcrux_aesgcm::aes_gcm_128::portable::Key::decrypt",
            "libcrux_aesgcm::aes_gcm_128::portable::KeyRef::decrypt",
            "libcrux_aesgcm::aes_gcm_128::portable::PortableAesGcm128::decrypt",
            "libcrux_aesgcm::aes_gcm_128::x64::Key::decrypt",
            "libcrux_aesgcm::aes_gcm_128::x64::KeyRef::decrypt",
            "libcrux_aesgcm::aes_gcm_128::x64::X64AesGcm128::decrypt",
            "libcrux_aesgcm::aes_gcm_256::AesGcm256::decrypt",
            "libcrux_aesgcm::aes_gcm_256::Key::decrypt",
            "libcrux_aesgcm::aes_gcm_256::KeyRef::decrypt",
            "libcrux_aesgcm::aes_gcm_256::neon::Key::decrypt",
            "libcrux_aesgcm::aes_gcm_256::neon::KeyRef::decrypt",
            "libcrux_aesgcm::aes_gcm_256::neon::NeonAesGcm256::decrypt",
            "libcrux_aesgcm::aes_gcm_256::portable::Key::decrypt",
            "libcrux_aesgcm::aes_gcm_256::portable::KeyRef::decrypt",
            "libcrux_aesgcm::aes_gcm_256::portable::PortableAesGcm256::decrypt",
            "libcrux_aesgcm::aes_gcm_256::x64::Key::decrypt",
            "libcrux_aesgcm::aes_gcm_256::x64::KeyRef::decrypt",
            "libcrux_aesgcm::aes_gcm_256::x64::X64AesGcm256::decrypt"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "libcrux-aesgcm",
        "purl": "pkg:cargo/libcrux-aesgcm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "AES-GCM decryption used an implementation for checking the provided\nauthentication tag against the recomputed authentication tag that was\nintended to be constant-time, but resulted in non-constant-time code\ngeneration in certain circumstances.\nNote that `libcrux-aesgcm` does not give guarantees on constant-time\ncode generation and possible mitigations must be considered\non a best-effort basis.\n\n## Impact\nUsers of `libcrux-aesgcm` that expose a decryption oracle to an\nattacker, which allows repeatedly querying for the same ciphertext\nwere at risk from timing side-channel attacks, depending on their\ncompilation environment. In the worst case, this could lead to\nrecovery of the recomputed authentication tag by the attacker, which\nenables ciphertext forgery.\n\n## Mitigation\nStarting from version `0.0.9` (published as `libcrux-aes@v0.0.9`),\nAES-GCM decryption uses a different, best-effort constant-time\nimplementation of the tag check, which has been checked to reliably\nlead to constant time code generation, at the moment.",
  "id": "RUSTSEC-2026-0211",
  "modified": "2026-07-17T11:34:24Z",
  "published": "2026-07-14T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/libcrux-aesgcm"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0211.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/celabshq/libcrux/pull/1528"
    }
  ],
  "related": [],
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Non-constant time Authentication Tag Check in AES-GCM Decryption"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.