From 2c53bea2cba5e990744e4828e2ff8731cf25b1e7 Mon Sep 17 00:00:00 2001 From: Dan Draper Date: Sun, 18 Oct 2026 12:20:37 +1100 Subject: [PATCH] fix(deps): take chacha20 0.10.2, since 0.10.0 and 0.10.1 were yanked chacha20 0.10.0 and 0.10.1 were yanked upstream for undefined behaviour (RustCrypto/stream-ciphers#579, fixed in RustCrypto/stream-ciphers#580). On an x86 CPU without AVX2 the crate falls back to its SSE2 backend, and that backend's RNG path calls `_mm_extract_epi32`, an SSE4.1 intrinsic, without checking for SSE4.1. A CPU with SSE4.1 runs it and gets the right answer; one without it (pre-2008 hardware, QEMU's default qemu64 model) dies with SIGILL. The keystream and the random numbers were never wrong. We reach it through `rand` 0.10, whose ThreadRng is ChaCha12, and through vitaminc-random. Both are in the native binaries @cipherstash/protect-ffi and @cipherstash/auth ship, hence the patch changeset. The fuzz workspaces move too, so no lockfile here still holds a yanked chacha20. The Go guests were already on 0.10.2. Only chacha20's version and checksum change in each lockfile. Claude-Session: https://claude.ai/code/session_01BZhkvKLpNtKuzj3HCfMXoL --- .changeset/chacha20-0-10-2.md | 6 ++++++ Cargo.lock | 4 ++-- languages/typescript/packages/protect-ffi/Cargo.lock | 4 ++-- packages/eql/Cargo.lock | 4 ++-- packages/stack-auth/fuzz/Cargo.lock | 4 ++-- packages/stack-encrypt/fuzz/Cargo.lock | 4 ++-- packages/stack-kms/fuzz/Cargo.lock | 4 ++-- 7 files changed, 18 insertions(+), 12 deletions(-) create mode 100644 .changeset/chacha20-0-10-2.md diff --git a/.changeset/chacha20-0-10-2.md b/.changeset/chacha20-0-10-2.md new file mode 100644 index 000000000..266d137e4 --- /dev/null +++ b/.changeset/chacha20-0-10-2.md @@ -0,0 +1,6 @@ +--- +'@cipherstash/protect-ffi': patch +'@cipherstash/auth': patch +--- + +Build the native binaries against `chacha20` 0.10.2. Versions 0.10.0 and 0.10.1 were yanked: on an x86 CPU without AVX2, their SSE2 fallback for the random number generator used an SSE4.1 instruction it had not checked the CPU for. A CPU without SSE4.1 (one from before 2008, or a virtual machine using QEMU's default `qemu64` CPU model) would crash with an illegal-instruction error. Every other CPU produced correct random numbers, so randomness was never weakened. No API change. diff --git a/Cargo.lock b/Cargo.lock index 5c8405d09..23a672105 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -464,9 +464,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" [[package]] name = "chacha20" -version = "0.10.0" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0", diff --git a/languages/typescript/packages/protect-ffi/Cargo.lock b/languages/typescript/packages/protect-ffi/Cargo.lock index c396bb090..d9c8e9553 100644 --- a/languages/typescript/packages/protect-ffi/Cargo.lock +++ b/languages/typescript/packages/protect-ffi/Cargo.lock @@ -483,9 +483,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" [[package]] name = "chacha20" -version = "0.10.0" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0", diff --git a/packages/eql/Cargo.lock b/packages/eql/Cargo.lock index 1c63b7750..6f2d161b6 100644 --- a/packages/eql/Cargo.lock +++ b/packages/eql/Cargo.lock @@ -519,9 +519,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" [[package]] name = "chacha20" -version = "0.10.0" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0", diff --git a/packages/stack-auth/fuzz/Cargo.lock b/packages/stack-auth/fuzz/Cargo.lock index 822d1f1f8..8fbec9d04 100644 --- a/packages/stack-auth/fuzz/Cargo.lock +++ b/packages/stack-auth/fuzz/Cargo.lock @@ -353,9 +353,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" [[package]] name = "chacha20" -version = "0.10.0" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0", diff --git a/packages/stack-encrypt/fuzz/Cargo.lock b/packages/stack-encrypt/fuzz/Cargo.lock index 086027d53..15c23beb7 100644 --- a/packages/stack-encrypt/fuzz/Cargo.lock +++ b/packages/stack-encrypt/fuzz/Cargo.lock @@ -308,9 +308,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "chacha20" -version = "0.10.0" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0", diff --git a/packages/stack-kms/fuzz/Cargo.lock b/packages/stack-kms/fuzz/Cargo.lock index a18c2eba9..c7e4cc7fd 100644 --- a/packages/stack-kms/fuzz/Cargo.lock +++ b/packages/stack-kms/fuzz/Cargo.lock @@ -304,9 +304,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "chacha20" -version = "0.10.0" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0",