CVE-2024-14041: ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)
In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term private key can recover that key. These are the KyberSlash1 (Poly.toMsg) and KyberSlash2 (ciphertext compression) divisions. Compression performed during encapsulation operates on values that become the public ciphertext and is not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-14041?
The severity of CVE-2024-14041 is high with a CVSS score of 8.2.
What issues does CVE-2024-14041 pose in Bouncy Castle for Java?
CVE-2024-14041 leaks private key information through non-constant-time division in message decoding and ciphertext compression.
How do I fix CVE-2024-14041?
To fix CVE-2024-14041, upgrade Bouncy Castle for Java to version 1.78 or later.
Which versions of Bouncy Castle are affected by CVE-2024-14041?
Bouncy Castle Java versions from 1.73 to before 1.78 are affected by CVE-2024-14041.
What functionality is compromised due to CVE-2024-14041?
CVE-2024-14041 compromises the security of routines like Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec.