CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves
Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing.
Other sources
Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 3.5.7-1~deb13u3Fixed in 3.6.5-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20240524git3e722403cd16-21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.7-7
Event History
Frequently Asked Questions
Which signing deployments are exposed to this timing leak?
Applications performing ECDSA signatures with Brainpool or other generic prime curves are affected. SM2 signing is affected on platforms that use the generic implementation; the impact is greatest for curves whose group order is on a machine-word boundary, such as brainpoolP384r1.
Are common NIST ECDSA curves affected?
No. The provided advisory states that NIST P-256, P-384, and P-521 have dedicated implementations and are not affected by the generic scalar-multiplication issue.
What must an attacker be able to do to recover a private key?
The attacker must be able to measure signing times and collect a large number of measurements. The individual timing leak is very small, but nonce information accumulated across signatures may support a lattice or Hidden Number Problem attack to recover the private key.