Description
The automatically reseeding implementations of HMAC-DRBG would panic if called with a desired non-zero output length cleanly divisible by `65_536`, the maximum number of output bytes that can be generated before reseeding has to happen.
# Impact
An application relying on `libcrux-hmac-drgb` to provide randomness of byte length a non-zero integer multiple of `65_536` in a single call to `fill_bytes` would panic.
Any calls with output buffer lengths not cleanly divisible by `65_536` are not affected.
# Mitigation
With release the release of version `0.0.2` of `libcrux-hmac-drbg` this bug has been fixed and reseeding DRBG implementations can be used with arbitrary output lengths.
We recommend users upgrade to `libcrux-hmac-drbg` version `0.0.2`.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | libcrux-hmac-drbg | >= 0.0.0-0, < 0.0.2 | 0.0.2 | RUSTSEC-2026-0329 |