CVE-2026-63569: MTI/A0 DHAgreement does not validate the peer's ephemeral value
Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is meant to provide. It also allows a malicious peer to learn the local static private key modulo the small factors of p-1, and to recover it entirely in groups with many such factors. The attack uses a crafted out-of-range or small-order ephemeral value, and works because that value is raised to the static private key without the range and subgroup-membership checks applied to DH public keys. Only applications that call DHAgreement directly are affected.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Only applications that call DHAgreement directly for the MTI/A0 two-pass Diffie-Hellman protocol are affected. The issue applies to bc-csharp versions before 2.7.0.
What does an attacker need to exploit this?
An on-path attacker can exploit the authentication failure by supplying a crafted out-of-range or small-order ephemeral value. A malicious peer can use such a value to obtain information about the local static private key.
What is the impact of a successful attack?
An attacker can cause the local party to compute an agreed value already known to the attacker, defeating the key authentication intended by MTI/A0. In groups where p-1 has many small factors, a malicious peer may be able to recover the local static private key entirely.
How can I determine whether my application is exposed?
Review whether the application directly invokes DHAgreement and uses MTI/A0 two-pass Diffie-Hellman. If it does, determine whether the deployed bc-csharp version is earlier than 2.7.0.