Dancing Offbit: ChaCha PRNG Typo Vulnerability
ID: b139ce52-de08-5b3b-8a4c-c0562141326b
STIX ID: report--b139ce52-de08-5b3b-8a4c-c0562141326b
Feed Name: NCC Research
Threat Score
This report describes a critical implementation bug in a ChaCha20-based PRNG implemented in Java where the use of a signed right shift (>>) instead of an unsigned right shift (>>>) in rotateLeft32() causes severe output bias (notably abundant 0xFF bytes), compromising cryptographic security; the issue was fixed by replacing the operator with >>> and corrected output distributions were observed.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
