# Crypto parameter and tag validation gaps

Crypto fields sliced or parsed from input without length, identity, or binding checks

_Area: Memory corruption and native code. Seen in 4 disclosed reports; latest 2026-10-21. Updated 2026-11-08._

## How it works
Crypto code trusts a parameter that arrives from outside: a tag, a limb, a keyslot cipher, an OID. The assumption that breaks is that the input already has the shape the algorithm needs. A fixed-size field is cut from a variable-length blob, so a short blob yields a short field [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4v26-v6cg-g6f9.md). A hint computes values but nothing ties them back to the source [E2](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AH-01.md). A header is used before it is authenticated [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-hq76-6gh2-5g4q.md). A parser resolves an identifier to the wrong scheme because of fallback order [E4](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-state-of-post-quantum-cryptography-implementations-html.md). In each case the check that would bind the input to the expected value is simply absent, and the primitive still returns success.

## Where it shows up
- Fixed-size fields (IV, tag, nonce) extracted with `substr()`/slicing from a caller-supplied blob, with no `strlen == LENGTH` check [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4v26-v6cg-g6f9.md)
- Hint/advice functions in circuits whose per-part checks exist but no recomposition equality (`value == high*2^n + low`) [E2](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AH-01.md)
- Disk or storage headers consumed before authentication; crypto libraries accepting null/identity ciphers in keyslot fields [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-hq76-6gh2-5g4q.md)
- OID or algorithm dispatch with a fallback order, where two schemes share a namespace [E4](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-state-of-post-quantum-cryptography-implementations-html.md)
- Key import paths that skip range or consistency checks on secret components [E4](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-state-of-post-quantum-cryptography-implementations-html.md)

## How to review
State the invariant and check it is enforced, not assumed:
- Every fixed-size crypto field is length-checked against its spec constant before use; a truncated tag must be rejected, not prefix-compared [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4v26-v6cg-g6f9.md)
- Every hinted/derived value has an explicit constraint binding it to the source value; internal checks inside a hint are not constraints [E2](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AH-01.md)
- Metadata that selects keys or ciphers is authenticated inside trusted memory before it is trusted [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-hq76-6gh2-5g4q.md)
- Identifier parsing is unambiguous: namespaced/offset variants are tried before the base scheme, and the resolved parameter set is compared to the expected one [E4](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-state-of-post-quantum-cryptography-implementations-html.md)
- Key parsing validates all secret components' ranges [E4](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-state-of-post-quantum-cryptography-implementations-html.md)

## How finders spotted it
- Read the decrypt path and noticed `$authTag` came from `substr()` with no length check; confirmed against OpenSSL docs that tag length is the caller's job and only prefix-matched [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4v26-v6cg-g6f9.md)
- Read the range-check helper, saw the hint compute limbs with no constraint tying them to `value`, and contrasted it with the correct recomposition already used elsewhere in the same file [E2](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AH-01.md)
- Traced how the TEE opens LUKS2 volumes, noted the header is unauthenticated, and checked cryptsetup's handling of null keyslot algorithms [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-hq76-6gh2-5g4q.md)
- Differential fuzzing across PQC libraries surfaced key-check discrepancies; code review of OID parsing flagged the XMSS-first fallback order [E4](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-state-of-post-quantum-cryptography-implementations-html.md)

## Variants seen
- Truncated authentication tag enabling brute force and GHASH key recovery [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4v26-v6cg-g6f9.md)
- Unbound witness limbs in a zero-knowledge circuit [E2](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AH-01.md)
- Unauthenticated storage header plus null cipher acceptance [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-hq76-6gh2-5g4q.md)
- OID collision resolved to wrong parameter set; missing key-component checks [E4](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-state-of-post-quantum-cryptography-implementations-html.md)

## Impact and severity
E1 escalates to full forgery and decryption of any AES-GCM node, requiring static key rotation. E3 lets a malicious host read secrets written under an attacker-known key, breaking the confidential-VM guarantee. E2 and E4 undermine soundness and key validation respectively. Impact rises when the gap is combined with an error oracle [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4v26-v6cg-g6f9.md) or with host control of storage [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-hq76-6gh2-5g4q.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **liboqs** (ML-DSA/ML-KEM key parsing) (version not stated): State of Post-Quantum Cryptography implementations. Report: https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-state-of-post-quantum-cryptography-implementations-html.md
- **robrichards/xmlseclibs (composer)** < 3.1.5, fixed in 3.1.5: xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption (CVE-2026-32313). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-4v26-v6cg-g6f9.md. Fix: https://github.com/robrichards/xmlseclibs/commit/03062be78178cbb5e8f605cd255dc32a14981f92
- **github.com/edgelesssys/constellation/v2 (go)** <= 2.23.1, fixed in 2.24.0: Constellation has insecure LUKS2 persistent storage partitions which may be opened and used (CVE-2025-58356). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-hq76-6gh2-5g4q.md. Fix: https://github.com/edgelesssys/constellation/commit/bb8d2c8a5c0a0a6510d2cc43055be21f4a3ab83c

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-4v26-v6cg-g6f9.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AH-01.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-hq76-6gh2-5g4q.md
- E4: https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-state-of-post-quantum-cryptography-implementations-html.md