{"id":"GHSA-346h-749j-r28w","aliases":[],"title":"PHPECC vulnerable to multiple cryptographic side-channel attacks","description":"### ECDSA Canonicalization\n\nPHPECC is vulnerable to malleable ECDSA signature attacks. \n\n### Constant-Time Signer\n\nWhen generating a new ECDSA signature, the GMPMath adapter was used. This class wraps the GNU Multiple Precision arithmetic library (GMP), which does not aim to provide constant-time implementations of algorithms.\n\nAn attacker capable of triggering many signatures and studying the time it takes to perform each operation would be able to leak the secret number, `k`, and thereby learn the private key.\n\n### EcDH Timing Leaks\n\nWhen calculating a shared secret using the `EcDH` class, the scalar-point multiplication is based on the arithmetic defined by the `Point` class.\n\nEven though the library implements a Montgomery ladder, the `add()`, `mul()`, and `getDouble()` methods on the `Point` class are not constant-time. This means that your ECDH private keys are leaking information about each bit of your private key through a timing side-channel.","severity":"critical","score":9.1,"published":"2024-04-25T18:31:58.000Z","modified":"2024-11-28T05:40:55.417Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"mdanter/ecc","ranges":[{"events":[{"introduced":"0"},{"last_affected":"1.0.0"}],"type":"ECOSYSTEM"}],"versions":["0.2.0","v0.3.0","v0.3.1","v0.3.2","v0.4.0","v0.4.1","v0.4.2","v0.4.3","v0.4.4","v0.4.5","v0.4.6","v0.4.7","v0.5.0","v0.5.1","v0.5.2","v1.0.0"],"fixed":[]}],"references":["https://github.com/FriendsOfPHP/security-advisories/blob/master/mdanter/ecc/2024-04-24.yaml","https://github.com/paragonie/phpecc/releases/tag/v2.0.0","https://github.com/phpecc/phpecc"],"sources":[{"name":"OSV","id":"GHSA-346h-749j-r28w","modified":"2024-11-28T05:40:55.417547Z","url":"https://osv.dev/vulnerability/GHSA-346h-749j-r28w"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1}]}