KyberSlash attacks put quantum encryption projects at risk

Multiple implementations of the CRYSTALS-Kyber post-quantum key encapsulation mechanism are affected by timing-based flaws collectively called KyberSlash that can leak secret keys during decapsulation. Researchers demonstrated key recovery in lab conditions, vendors released patches for some libraries while several popular implementations (including components used by Signal) were initially unpatched, and impact depends on deployment details and key usage patterns.