oqs's Post-Quantum Signature scheme Rainbow level I parametersets broken
High severity
GitHub Reviewed
Published
Aug 18, 2022
to the GitHub Advisory Database
•
Updated Jan 7, 2023
Description
Published to the GitHub Advisory Database
Aug 18, 2022
Reviewed
Aug 18, 2022
Last updated
Jan 7, 2023
Ward Beullens found a practical key-recovery attack against Rainbow.
The level I parametersets are removed from liboqs starting from version
0.7.2
.Find the scientific details in Breaking Rainbow Takes a Weekend on a Laptop.
This means all the
oqs::sig::Algorithm::RainbowI*
variants are insecure.References