Executive Summary

This vulnerability involves the ML-KEM ARM64 NEON ciphertext comparison process, which only compares half of the input ciphertext. This flaw breaks the Fujisaki-Okamoto transform's implicit rejection mechanism, weakening the IND-CCA2 security on that code path.

Because the constant-time comparison ignores part of the re-encrypted ciphertext, a decapsulating party might fail to detect a manipulated ciphertext and proceed without performing the required implicit rejection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to manipulate ciphertexts without detection during the decapsulation process. As a result, the security guarantees of the cryptographic scheme are weakened, potentially allowing unauthorized access or data compromise due to the failure to reject invalid ciphertexts.

Useful 0 Not Useful 0