Nicola
e3d1254f1e
The in-memory keyring cannot enforce constraint extensions, so silently accepting a key that carries them gave callers a false sense of restriction. Refuse keys with constraint extensions instead: a key whose constraints cannot be enforced must not be loaded. This behavior is consistent with OpenSSH. This is a deliberate behavior change: keyring.Add previously accepted and ignored ConstraintExtensions and now returns an error. This issue was found during a security audit by NCC Group Cryptography Services, sponsored by Teleport. Fixes CVE-2026-39832 Fixes golang/go#79435 Change-Id: I6ca4f1c29f8edfabb287fe07299641f70896d5fe Reviewed-on: https://go-review.googlesource.com/c/crypto/+/778641 Auto-Submit: Neal Patel <nealpatel@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Neal Patel <neal@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Neal Patel <nealpatel@google.com>
Go Cryptography
This repository holds supplementary Go cryptography packages.
Report Issues / Send Patches
This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.
The git repository is https://go.googlesource.com/crypto.
The main issue tracker for the crypto repository is located at https://go.dev/issues. Prefix your issue with "x/crypto:" in the subject line, so it is easy to find.
Note that contributions to the cryptography package receive additional scrutiny due to their sensitive nature. Patches may take longer than normal to receive feedback.