BSD PortsTiming leaks of the nonce in ECDSA, EdDSA and DSA signatures
Helder Eijs reports Fix timing leaks of the nonce in ECDSA, EdDSA and DSA signatures The signing time depended on the secret nonce, enough to recover the private key with a lattice attack. - EC: scalars are encoded and processed on the full length of the order, and ec_mix_add() is constant time for the point at infinity (a zero digit). - DSA: g^k uses k + q or k + 2q (fixed length) and mpz_powm_sec, or the library's …
Affected versions
- py312-pycryptodome, py312-pycryptodomex, py313-pycryptodome, py313-pycryptodomex, py313t-pycryptodome, py313t-pycryptodomex, py314-pycryptodome, py314-pycryptodomex, py314t-pycryptodome, py314t-pycryptodomex, py311-pycryptodome, py311-pycryptodomex, py315-pycryptodome, py315-pycryptodomex, py27-pycryptodome, py27-pycryptodomex < 3.24.1
By system
2 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | security/py-pycryptodome | 3.24.1 | fixed | (2 days after) |
| MidnightBSD | security/py-pycryptodome | 3.21.0_1 | in range, by version | |
| FreeBSD | security/py-pycryptodomex | 3.24.1 | fixed | |
| MidnightBSD | security/py-pycryptodomex | in range, by version | ||
| DragonFly | security/py-pycryptodome | 3.21.0 | vulnerable since 2026-10-12 | |
| DragonFly | security/py-pycryptodomex | 3.21.0 | vulnerable since 2026-10-12 |