Wolfprovider
Monthly
Nonce reuse in wolfProvider before 1.2.2 completely breaks AES-GCM confidentiality and integrity guarantees for every TLS 1.2 and DTLS 1.2 connection using that cipher suite. Because the 8-byte explicit nonce is set once at key establishment and never incremented, every record in a session is encrypted under an identical (key, nonce) pair - the classical 'forbidden attack' condition where XORing two ciphertexts yields the XOR of the plaintexts, and the GHASH authentication key can be algebraically recovered to enable tag forgery. No active exploitation is confirmed in CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the attack is well-understood cryptography with no special tooling required beyond captured traffic.
Nonce reuse in wolfProvider before 1.2.2 completely breaks AES-GCM confidentiality and integrity guarantees for every TLS 1.2 and DTLS 1.2 connection using that cipher suite. Because the 8-byte explicit nonce is set once at key establishment and never incremented, every record in a session is encrypted under an identical (key, nonce) pair - the classical 'forbidden attack' condition where XORing two ciphertexts yields the XOR of the plaintexts, and the GHASH authentication key can be algebraically recovered to enable tag forgery. No active exploitation is confirmed in CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the attack is well-understood cryptography with no special tooling required beyond captured traffic.