Monocypher

Known Bugs

• Versions 4.0.3 and below expose a time dependent branch for the constant time comparison functions, that leaks the return value (0 or -1), when compiled with specific compilers & platforms. This is rarely a problem in practice, because that return value is normally never secret. Only users that do something clever like comparing longer buffers and combining the results are affected. (Found by Zahiya Zahid)

Old Bugs

• Versions 4.0.2 and below enable a timing leak vulnerability on EdDSA and Ed25519 signatures, when compiled with specific compilers & compiler options. You can check whether your binary is vulnerable or not by running ctgrind.

• Versions 4.0.0 and 4.0.1 have a flawed Argon2 implementation that gives incorrect results when used with multiple lanes.

• Version 3.1.0 and below have an integer overflow when used on 16-bit platforms that makes elliptic curves unusable. (The fix has been back ported to versions 2.0.7 and 1.1.2.)

• Version 2.0.3 and below have a critical vulnerability that cause crypto_check() to accept bogus signatures as genuine. (The fix has been back ported to version 1.1.1.) Full disclosure.

• Version 2.0.2 and below read uninitialised memory when computing BLAKE2b hashes, which is undefined behaviour under the C and C++ standards. Current compilers generate correct code.

• Versions between 1.1.0 and 2.0.1 fail to compile when we turn on Ed25519 compatibility.

• Versions 1.0.1 and below use crypto_memcmp(), which could not be guaranteed to run in constant time in practice, despite the absence of secret-dependent branch in the original source code. The fear of subsequent timing attacks led to its deprecation. Version 1.1.0 and above use the fixed size crypto_verify*() functions instead.

• Versions 2.0.1 and below fail to wipe some of their internal buffers.

• Versions 1.0.0 and below do not wipe their internal buffers. This can facilitate the exfiltration of data if the computer Monocypher runs on is compromised.