Post B4Bex6TsdmKDhBC8e0 by jas@fosstodon.org
 (DIR) More posts by jas@fosstodon.org
 (DIR) Post #B4BdRkKArtQu2y8ewK by jas@fosstodon.org
       0 likes, 0 repeats
       
       ”Cryspen’s Approach to TLS: A Critical Analysis” https://symbolic.software/blog/2026-03-07-cryspen-tls/ - I feel less confident about OpenSSH’s ML-KEM libcrux approach now
       
 (DIR) Post #B4BdRka7uaC2qRbOnw by kpcyrd@chaos.social
       0 likes, 0 repeats
       
       @jas It looks like there have been rustsec advisories (RUSTSEC-2026-00{23,24,25,26}), but only one of them has a severity of 'high', the other ones have a severity of 'none'.Anybody can send pull requests to the advisory-db, maybe the author of the blogpost could add to them and adjust the impact/severity/description/title.Note also (by @djc):https://github.com/cryspen/libcrux/issues/1335
       
 (DIR) Post #B4BdRkeNelb13danR2 by jas@fosstodon.org
       0 likes, 0 repeats
       
       “verification theatre” - https://eprint.iacr.org/2026/192
       
 (DIR) Post #B4BdRkoJ3rXHYQEiuG by jas@fosstodon.org
       0 likes, 1 repeats
       
       @kpcyrd @djc Another concern is the Rust to C conversion, that could introduce fun stuff. Reading the 10+kloc https://github.com/openssh/openssh-portable/blob/master/libcrux_mlkem768_sha3.h is not pleasant. Generated by https://github.com/AeneasVerif/eurydice
       
 (DIR) Post #B4BdYlJVaYMz8sAlnM by civodul@toot.aquilenet.fr
       0 likes, 0 repeats
       
       @jas So the OpenSSL repo now contains stuff that is not source⁈How do distros like Debian deal with that?@djc @kpcyrd
       
 (DIR) Post #B4Bex6TsdmKDhBC8e0 by jas@fosstodon.org
       0 likes, 0 repeats
       
       @civodul @djc @kpcyrd That would be OpenSSH, although I suspect modern OpenSSL may include similar stuff.  Generated code like this is more common than most would want to admit. Debian sometime rebuild things, but in practice rely on upstreams being aligned on that. Debian include this generated file verbatim. Another concern is that ML-KEM is used under a patent license. My perception is that people are tired of caring about free software philosophy.
       
 (DIR) Post #B4DZSr5dBmInooWt4C by jas@fosstodon.org
       0 likes, 1 repeats
       
       @civodul @djc @kpcyrd https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130568