Executive brief
libcrux-ml-dsa is a Rust library providing post-quantum cryptographic digital signature algorithms. A flaw in its high-performance AVX2 implementation causes the library to incorrectly verify certain digital signatures. An attacker could exploit this to make the system accept a forged or invalid signature, potentially allowing them to bypass security checks or impersonate authorized users.
Technical details
A vulnerability exists in the AVX2-optimized implementation of ML-DSA (Module-Lattice-Based Digital Signature Standard) within the libcrux-ml-dsa crate. The root cause is an incorrect implementation of the `use_hint` function (Algorithm 40 in FIPS 204), specifically regarding the handling of the edge case where the remainder $r_0$ equals 0. While the specification requires $r_0 \le 0$ to trigger a specific modular reduction, the AVX2 implementation using the `vec256_blendv_epi32` intrinsic only checked for $r_0 < 0$. This discrepancy allows an attacker to craft an invalid signature under a maliciously generated verification key that the verifier will incorrectly accept as valid. The issue is fixed in version 0.0.9 by correctly masking the comparison to include the $r_0 = 0$ case.
Affected products
- cryspen libcrux-ml-dsa < 0.0.9
Timeline
- 2026-04-02: other: Similar issue identified in Tink-Go implementation
- 2026-05-05: other: Fix submitted to libcrux repository
- 2026-05-19: advisory: GitHub Advisory published
- 2026-05-19: patched: Fixed in version 0.0.9