GHSA-346h-749j-r28w PHPECC vulnerable to multiple cryptographic side-channel attacks
PHPECC library leaks private keys via timing side-channels in ECDSA and ECDH operations, allowing attackers to recover secrets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-346h-749j-r28w?
GHSA-346h-749j-r28w is a vulnerability in mdanter/ecc, published on 25 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ECDSA Canonicalization
PHPECC is vulnerable to malleable ECDSA signature attacks.
Constant-Time Signer
When generating a new ECDSA signature, the GMPMath adapter was used. This class wraps the GNU Multiple Precision arithmetic library (GMP), which does not aim to provide constant-time implementations of algorithms.
An attacker capable of triggering many signatures and studying the time it takes to perform each operation would be able to leak the secret number, k, and thereby learn the private key.
EcDH Timing Leaks
When calculating a shared secret using the EcDH class, the scalar-point multiplication is based on the arithmetic defined by the Point class.
Even though the library implements a Montgomery ladder, the add(), mul(), and getDouble() methods on the Point class are not constant-time. This means that your ECDH private keys are leaking information about each bit of your private key through a timing side-channel.
Which versions are affected by GHSA-346h-749j-r28w?
2 open source packages ship an affected version, including mdanter/ecc.
| Package | Affected | Fixed in |
|---|---|---|
mdanter/ecc Packagist | All versions to 1.0.0 | None |
mdanter/ecc Packagist | All versions to 1.0.0 | None |
How do I fix GHSA-346h-749j-r28w?
No fix has been published for GHSA-346h-749j-r28w yet. Limit exposure of the affected software until one is available.
Is GHSA-346h-749j-r28w being exploited?
There is no known exploitation of GHSA-346h-749j-r28w in the wild and no public exploit code.