RUSTSEC-2024-0344: Timing variability in curve25519-dalek
's Scalar29::sub
/Scalar52::sub
#6
Labels
curve25519-dalek
's Scalar29::sub
/Scalar52::sub
#6
curve25519-dalek
3.2.0
>=4.1.3
Timing variability of any kind is problematic when working with potentially secret values such as
elliptic curve scalars, and such issues can potentially leak private keys and other secrets. Such a
problem was recently discovered in
curve25519-dalek
.The
Scalar29::sub
(32-bit) andScalar52::sub
(64-bit) functions contained usage of a mask valueinside a loop where LLVM saw an opportunity to insert a branch instruction (
jns
on x86) toconditionally bypass this code section when the mask value is set to zero as can be seen in godbolt:
A similar problem was recently discovered in the Kyber reference implementation:
<https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/hqbtIGFKIpU/m/cnE3pbueBgAJ>
As discussed on that thread, one portable solution, which is also used in this PR, is to introduce a
volatile read as an optimization barrier, which prevents the compiler from optimizing it away.
The fix can be validated in godbolt here:
The problem was discovered and the solution independently verified by
Alexander Wagner <[email protected]> and Lea Themint <[email protected]> using
their DATA tool:
<https://github.com/Fraunhofer-AISEC/DATA>
See advisory page for additional details.
The text was updated successfully, but these errors were encountered: