sntrup761: implicit-rejection key differs from the specification since 4e963e91

[Jussi Kivilinna]

Hello,

On 05/11/2026 22:31, 007bsd wrote:
> Hello,
> 
> libgcrypt's sntrup761 decapsulation returns a different rejection key
> from the specification since a constant-time refactor in 2025. I found
> no attack (reasoning below), so I am reporting it here as a normal bug
> with a one-line fix.
> 

Thanks for reporting. I've created ticket in issue tracker for this:
  https://dev.gnupg.org/T8542

-Jussi