ppv-lite86 appears unsound

[gendx]

There is a pull request open for almost a year on the ppv-lite86 to fix unsoundness: cryptocorrosion/cryptocorrosion#72. I didn't see activity on the repository since November 2022, so this doesn't look like it will be addressed any time soon.

Note that this is depended on by 14k crates, as it is a direct dependency of the rand_chacha crate.

[tarcieri]

You might mention this issue on that thread as a heads up, i.e. "There's an open issue to file a security advisory for this"

[gendx]

You might mention this issue on that thread as a heads up, i.e. "There's an open issue to file a security advisory for this"

Done.