CVE-2026-18036: NTRU leaks private key information by reducing secret values with a non-constant-time integer division
In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a variable divisor, which a compiler cannot strength-reduce to a multiply the way it can a constant one, so it emitted a division on every call including on the decapsulation path where the dividend derives from the private key; Polynomial.mod3 and NTRUSampling.mod3 divided the secret key polynomials f and g during key generation, the message polynomials r and m during encapsulation, and coefficients recovered during decapsulation. An attacker able to measure that timing can recover information about the NTRU private key. modQ now masks, which is exact because q is always a power of two, and mod3 uses the reference implementation's division-free fold and select; the results are unchanged.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this timing side channel?
Bouncy Castle for Java versions before 1.86 are affected where NTRU operations are used. The issue occurs during NTRU key generation, encapsulation, and decapsulation, with decapsulation specifically processing values derived from the private key.
What does an attacker need to exploit the issue?
An attacker must be able to measure timing differences from NTRU operations. The vulnerable integer divisions have latency dependent on secret operands, allowing timing observations to reveal information about the NTRU private key.
What should be done if an affected version is in use?
Upgrade Bouncy Castle for Java to version 1.86 or later. The corrected implementation replaces the secret-dependent division behavior with division-free reductions while preserving the reduction results.