From 23f07638bf0aedd000bfd75727eff1ad9dd4144c Mon Sep 17 00:00:00 2001 From: Douglas Stebila Date: Wed, 28 Oct 2026 12:12:40 -0400 Subject: [PATCH] Prepare 0.16.0.2 release Maintenance release of liboqs-python 0.16.0 carrying the fix for GHSA-w696-4vrr-x6x3 (ML-DSA signature forgery and ML-KEM shared-secret recovery when an application passes an empty or very short public key). It still pairs with liboqs 0.16.0. - Bump version 0.16.1-dev -> 0.16.0.2 (pyproject.toml); the runtime auto-installer maps this to the liboqs 0.16.0 tag. - CHANGES.md: add the 0.16.0.2 section. - RELEASE.md: rewrite for 0.16.0.2, leading with the security fix and listing the behavior changes from #160 and #161. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Douglas Stebila --- CHANGES.md | 16 +++++++++++++ RELEASE.md | 65 ++++++++++++++++++++++++++++++++------------------ pyproject.toml | 2 +- 3 files changed, 59 insertions(+), 24 deletions(-) diff --git a/CHANGES.md b/CHANGES.md index 323cedf..7a14c6e 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -1,3 +1,19 @@ +# Version 0.16.0.2 - October 28, 2026 + +- Security fix: public keys, ciphertexts and secret keys of the wrong length + now raise `ValueError`. Previously a short value was zero-padded, which + allowed ML-DSA signature forgery and ML-KEM shared-secret recovery when an + application passed an empty or very short public key, and + `StatefulSignature.verify` read past the end of a short public key, + https://github.com/open-quantum-safe/liboqs-python/security/advisories/GHSA-w696-4vrr-x6x3 +- Fixed `StatefulSignature` leaking its native `OQS_SIG_STFL` struct and secret + key; `free()` now securely erases and frees both, is safe to call more than + once on every class, and makes later `StatefulSignature` method calls raise + `RuntimeError`, + https://github.com/open-quantum-safe/liboqs-python/pull/160 +- Fixed publishing to PyPI, which rejected packages built with hatchling 1.32, + https://github.com/open-quantum-safe/liboqs-python/pull/158 + # Version 0.16.0.1 - September 23, 2026 - Security fix: the automatic liboqs installation no longer runs commands diff --git a/RELEASE.md b/RELEASE.md index f3f4532..cc8bd9a 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -1,29 +1,48 @@ -# liboqs-python version 0.16.0.1 +# liboqs-python version 0.16.0.2 --- This is a maintenance release of liboqs-python 0.16.0 that fixes a security issue. It is still built for liboqs 0.16.0. All users of liboqs-python -0.10.0 through 0.16.0 who rely on liboqs being installed automatically -should upgrade. - -# Security fix in version 0.16.0.1 - -- **Shell command injection in automatic liboqs installation** - ([GHSA-pw23-r5gj-42g8](https://github.com/open-quantum-safe/liboqs-python/security/advisories/GHSA-pw23-r5gj-42g8)). - When liboqs was not found at import time, liboqs-python built it by running - git and CMake through a shell, so shell metacharacters in `PYOQS_VERSION`, - `OQS_INSTALL_PATH`, `HOME`, or `TMPDIR` could execute arbitrary commands. - These commands now run without a shell, and `PYOQS_VERSION` is validated. - -# Other changes in version 0.16.0.1 - -- Fixed automatic installation of liboqs release candidates (e.g., - `0.16.0-rc1`) and install paths that contain spaces. -- Added support for the ML-DSA external-mu variants when liboqs provides them - (they are not in liboqs 0.16.0). -- Added installation instructions for Windows and Raspberry Pi. -- Releases are now published to PyPI automatically. +0.16.0.1 or earlier should upgrade. + +# Security fix in version 0.16.0.2 + +- **ML-DSA signature forgery and ML-KEM shared-secret recovery with short + public keys** + ([GHSA-w696-4vrr-x6x3](https://github.com/open-quantum-safe/liboqs-python/security/advisories/GHSA-w696-4vrr-x6x3)). + liboqs-python did not check the length of public keys, ciphertexts, and + secret keys, and silently zero-padded a short value before passing it to + liboqs. If an application passed an empty or very short public key, for + example because a key field was missing or truncated, `Signature.verify` + could accept a forged ML-DSA signature on any message, and + `KeyEncapsulation.encap_secret` could produce an ML-KEM shared secret that + anyone who sees the ciphertext can compute. `StatefulSignature.verify` + instead let liboqs read past the end of a short public key. Public keys, + ciphertexts, and secret keys of the wrong length now raise `ValueError`. + +# Other fixes in version 0.16.0.2 + +- **`StatefulSignature` releases its native resources.** `free()`, which is + also called when a `with` block exits, now frees the native `OQS_SIG_STFL` + struct and securely erases and frees the native secret key. Both previously + leaked. +- **`free()` is safe to call more than once.** Calling `free()` on a + `KeyEncapsulation` or `Signature` after its `with` block had exited + previously freed the native struct twice. + +# Behavior changes in version 0.16.0.2 + +These fixes can make code that previously ran without error raise an +exception: + +- A public key, ciphertext, or secret key of the wrong length raises + `ValueError`. An empty `secret_key` passed to the `KeyEncapsulation` or + `Signature` constructor also raises `ValueError` instead of being ignored. +- Calling a `StatefulSignature` method after `free()` raises `RuntimeError`. + Previously it could crash, and `verify()` returned `False`. +- `StatefulSignature.free()` erases the native secret key, so call + `export_secret_key()` first if you still need it. ## About @@ -47,9 +66,9 @@ See in particular limitations on intended use. ## Release notes -This release of liboqs-python was released on September 23, 2026. Its release +This release of liboqs-python was released on October 28, 2026. Its release page on GitHub is -https://github.com/open-quantum-safe/liboqs-python/releases/tag/0.16.0.1. +https://github.com/open-quantum-safe/liboqs-python/releases/tag/0.16.0.2. --- diff --git a/pyproject.toml b/pyproject.toml index 48f102a..bf765d7 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,7 +1,7 @@ [project] name = "liboqs-python" requires-python = ">=3.10" -version = "0.16.1-dev" +version = "0.16.0.2" description = "Python bindings for liboqs, providing post-quantum public key cryptography algorithms" authors = [ { name = "Open Quantum Safe project", email = "contact@openquantumsafe.org" },