--- title: "Cryptographic Issues in Matrix’s Rust Library Vodozemac" url: https://daily.dev/posts/cryptographic-issues-in-matrix-s-rust-library-vodozemac-2cyxpiet3 source_url: https://soatok.blog/2026/02/17/cryptographic-issues-in-matrixs-rust-library-vodozemac/ type: article source: "Dhole Moments" published: 2026-02-17T23:45:43.354Z updated: 2026-02-17T23:46:22.186Z tags: ["security", "rust", "cryptography"] reading_time: 20 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cryptographic Issues in Matrix’s Rust Library Vodozemac **[Dhole Moments](https://daily.dev/sources/soatok)** · 20 min read · 1 upvotes · 0 comments ## Summary Security researcher Soatok discovered multiple cryptographic vulnerabilities in Matrix's Rust library vodozemac, including a critical flaw where the Olm Diffie-Hellman implementation accepts all-zero public keys (the identity element), leading to predictable shared secrets. Additional issues include silent downgrades from V2 to V1 protocol (truncating MACs from 256 to 64 bits), weak ECIES CheckCode implementation, and disabled strict Ed25519 verification by default. The researcher provided patches and proof-of-concept exploits, disclosed publicly after one week rather than the typical 90 days due to Matrix's poor handling of previous vulnerability reports. Both the deprecated libolm and newer vodozemac libraries are affected by the identity element vulnerability. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [We found cryptography bugs in the elliptic library using Wycheproof](https://daily.dev/posts/we-found-cryptography-bugs-in-the-elliptic-library-using-wycheproof-togrvgscx) · Hacker News · 1 upvotes · 0 comments - [A vulnerability in libsodium](https://daily.dev/posts/a-vulnerability-in-libsodium-ogxw99g90) · Hacker News · 0 upvotes · 0 comments - [Cryptographer fights RustSec ban over bug reports](https://daily.dev/posts/cryptographer-fights-rustsec-ban-over-bug-reports-67igoasfx) · The Register · 0 upvotes · 0 comments - [Critical flaw in wolfSSL library enables forged certificate use](https://daily.dev/posts/critical-flaw-in-wolfssl-library-enables-forged-certificate-use-3x0xohq0b) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#rust](https://daily.dev/tags/rust), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/cryptographic-issues-in-matrix-s-rust-library-vodozemac-2cyxpiet3)