CIRCL v1.6.5

What's Changed

• ascon: don't output plaintext if authentication fails by @bwesterb in #631
• Dilithium: don't accept signatures with trailing data by @bwesterb in #632
• Fix HPKE/KEM exact-length key unmarshaling by @drmikecrypto in #627
• Bump x/crypto and golangci-lint by @bwesterb in #637
• ecc/bls12381: reject trailing data in G1/G2 SetBytes by @bwesterb in #636
• eddilithium: fail verification if signature is wrong length by @bwesterb in #633
• tss/rsa: fix length check to prevent runtime out-of-bounds panic by @bwesterb in #640
• dleq: verify: return false instead of panic()ing on nil parameters by @bwesterb in #641
• ed448: document verification behaviour by @bwesterb in #642
• ed448: reject non-canonical point encodings by @bwesterb in #635
• slhdsa: ensure full reads when rand source is provided by @bwesterb in #634
• ed{25519,448}: don't accept trailing data for keys by @bwesterb in #643
• frodo: pack: fix accidental zero buffer assumption by @bwesterb in #645
• secretsharing: check that share ID is not zero. by @bwesterb in #644
• kyber: document pk isn't checked like ML-KEM by @bwesterb in #648
• zk/dleq: Don't accept trailing data on proof by @bwesterb in #649
• slhdsa: don't panic if prehash-hash is out of range by @bwesterb in #647
• goldilocks: don't panic when unmarshalling invalid point by @bwesterb in #646
• hpke: don't panic when unmarshalling opener/sealer from empty buffer by @bwesterb in #656
• ot/simot: don't panic on mismatched ciphertext lengths by @bwesterb in #655
• fourq: document point decoding is lenient by @bwesterb in #654
• oprf: add note on multiple Point encodings by @bwesterb in #653
• tss/rsa: don't panic when combining empty list of shares by @bwesterb in #652
• ecc/p384: document that package is not fully constant time by @bwesterb in #651
• ristretto: reject non-canonical scalars by @bwesterb in #650
• Add more explicit constant time warnings by @bwesterb in #638
• mlsbset: make Encode() constant time by @bwesterb in #639
• mlsbset: fix stray index in Encode comment by @lukevalenta in #658
• removeLen32Prefixed: check for possible data overflow by @mdosch in #629
• expander: panic if requested output length overflows DST. by @cjpatton in #664
• zk/dleq: add base point a to challenge derivation. by @cjpatton in #663
• dh/sidh: document Import() side-effect for kem/sike. by @cjpatton in #662
• ecc/fourq: improve constant-timeness of fpSgn, fqSqrt. by @cjpatton in #666
• blinsign/blindrsa/partiallyblindrsa: reject malformed moduli. by @cjpatton in #665
• blindsign/blindrsa: align PSSZERO behavior with RFC 9474. by @cjpatton in #660
• ecc/fourq: fix fqSqr arithmetic error on amd64 by @cjpatton in #659
• README: warn that not all packages are constant time by @frangelbarrera in #668
• internal/test: unify ACVP test vector parsing by @ihopenre-eng in #667
• blindrsa: fix interface documentation by @bwesterb in #672
• ecc/fourq: fix legacy (non-BMI2) GF(p^2) multiplication on amd64 by @bwesterb in #669
• p384: document assumed reductions by @bwesterb in #670
• ed25519: document another divergence with crypto/ed25519 by @bwesterb in #671
• prio3/histogram: don't panic on measurement equal to the bucket count by @bwesterb in #673
• zk/qndleq: document Qn membership precondition by @bwesterb in #675
• vdaf/prio3: require all prep shares by @bwesterb in #676
• vdaf/prio3: document prep sequencing requirement by @bwesterb in #677
• zk/dl: reject identity proof inputs by @bwesterb in #678
• tss/rsa: document trusted modulus requirement by @bwesterb in #680
• dh/csidh: harden key imports by @bwesterb in #689
• zk/dleq: validate batch shape by @bwesterb in #684
• ot/simot: make sender sessions one-shot by @bwesterb in #679
• vdaf/prio3/sum: reject unsafe measurement bounds by @bwesterb in #682
• tss/rsa: validate sign share protocol parameters by @bwesterb in #674
• vdaf/prio3/sum: reject aggregate field overflow by @bwesterb in #681
• vdaf/prio3: validate preparation inputs by @bwesterb in #683
• oprf: reject invalid deterministic blinds by @bwesterb in #688
• vdaf/prio3: reject degenerate parameters by @bwesterb in #685
• oprf: validate finalize state by @bwesterb in #687

New Contributors

• @drmikecrypto made their first contribution in #627
• @lukevalenta made their first contribution in #658
• @mdosch made their first contribution in #629
• @frangelbarrera made their first contribution in #668
• @ihopenre-eng made their first contribution in #667

Full Changelog: v1.6.4...v1.6.5