007bsd

Research

Preprints

Papers on IACR ePrint, with code and BibTeX.

ePrint 2026/2239

One Unverified Coordinate Is Enough: Key Recovery from Faulty Fujisaki–Okamoto Rejection Checks in ML-KEM

Bhabani Sankar Das · Attacks and cryptanalysis

A general fault model for the Fujisaki–Okamoto rejection check in ML-KEM and Kyber. Deployed implementations have realised the check incorrectly, through a skipped conditional move or a truncated ciphertext comparison, and a single unverified coordinate is enough to recover the secret key.

Abstract PDF Code
BibTeX
@misc{cryptoeprint:2026/2239,
  author       = {Bhabani Sankar Das},
  title        = {One Unverified Coordinate Is Enough: Key Recovery from Faulty Fujisaki–Okamoto Rejection Checks in ML-KEM},
  howpublished = {Cryptology {ePrint} Archive, Paper 2026/2239},
  year         = {2026},
  url          = {https://eprint.iacr.org/2026/2239}
}
ePrint 2026/1682

Incomplete Ciphertext Comparison in ML-KEM: From an IND-CCA2 Break to Key Recovery

Bhabani Sankar Das · Attacks and cryptanalysis

wolfSSL's hand-written AVX2 and NEON implementations of the ML-KEM re-encryption check compared only part of the ciphertext. The unchecked bytes form a plaintext-checking oracle that recovers most of an ML-KEM-1024 private key with ordinary least squares.

Abstract PDF Code
BibTeX
@misc{cryptoeprint:2026/1682,
  author       = {Bhabani Sankar Das},
  title        = {Incomplete Ciphertext Comparison in ML-KEM: From an IND-CCA2 Break to Key Recovery},
  howpublished = {Cryptology {ePrint} Archive, Paper 2026/1682},
  year         = {2026},
  url          = {https://eprint.iacr.org/2026/1682}
}

Cited in

Other researchers' work that uses or credits these papers.

  1. Re: Round1: Public Comment: Amoeba PKC Forum (ICCS) Jinnuo Li uses a method similar to ePrint 2026/1682 to recover the secret keys of all ten official Amoeba-576 test vectors, in China’s next-generation commercial cryptography competition
  2. Amoeba (kem-02), finding kem-02-1 ngcc.dev Cryptanalysis tracker maintained by Markku-Juhani O. Saarinen; describes the Amoeba flaw as a plaintext-checking primitive of the type developed in ePrint 2026/1682

Coverage

Articles about the research.

  1. Crypto-Agility Is the Goal. The PQC Migration Is Only Its First Test. PostQuantum.com Cites the ML-KEM-1024 key-recovery result (ePrint 2026/1682)
  2. AVX2 Flaw in pqc_kyber and cosmian_kyber Enables Kyber Secret-Key Recovery Mallory Threat-intelligence story on the RustSec advisories, citing the fix pull requests
  3. wolfSSL ML-KEM SIMD Flaws Enable Private-Key Recovery Mallory Threat-intelligence story on CVE-2026-10097 and CVE-2026-6330, citing the preprint
  4. An Incomplete FO Check Turned wolfSSL's ML-KEM Into Key Recovery PostQuantum.com On ePrint 2026/1682 and the wolfSSL disclosure