logo

Dancing Offbit: ChaCha PRNG Typo Vulnerability

ID: b139ce52-de08-5b3b-8a4c-c0562141326b

STIX ID: report--b139ce52-de08-5b3b-8a4c-c0562141326b

Feed Name: NCC Research

Threat Score
70/100

Date Published: 2026-05-13

Date Updated: 2026-07-31

...
...

This report describes a critical implementation bug in a ChaCha20-based PRNG implemented in Java where the use of a signed right shift (>>) instead of an unsigned right shift (>>>) in rotateLeft32() causes severe output bias (notably abundant 0xFF bytes), compromising cryptographic security; the issue was fixed by replacing the operator with >>> and corrected output distributions were observed.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.