CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation
Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel.
Other sources
Timing Side-Channel in SM2 Signature Generation
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 3.5.7-1~deb13u3Fixed in 3.6.5-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.7-7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20240524git3e722403cd16-21
Event History
Frequently Asked Questions
Who is exposed to this timing side channel?
Applications that perform SM2 signature generation are affected on all platforms. The issue applies to SM2 signing operations because variable-time BIGNUM arithmetic processes the secret nonce and private key.
What does an attacker need to exploit the issue?
An attacker needs to be able to measure SM2 signing times across many signatures. Those measurements may reveal information about per-signature secret nonces that can be used in a lattice or Hidden Number Problem attack to recover the private key.
Does this affect FIPS-approved cryptographic operations?
No. SM2 is not a FIPS algorithm, so the advisory states there is no FIPS impact.