CVE-2026-84308: phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add() and subtract(). During the Montgomery ladder in phpseclib/Crypt/EC/BaseCurves/Montgomery.php, the reduction behavior of each step depends on the secret scalar prefix, creating per-step timing and libgmp call-count observations that can reveal a reused 251-bit clamped private scalar. The phpseclib/Crypt/EC/Formats/Keys/MontgomeryPrivate.php derivation path invokes the pure-PHP multiplication without a native-engine check, while phpseclib/Crypt/EC/Formats/Keys/PKCS8.php reaches it when ext-sodium is unavailable. Exploitation requires a reused or long-lived X25519 private key, knowledge of the corresponding public key, execution of the pure-PHP path, and a local observer capable of resolving individual ladder steps or libgmp entry-point calls. Ephemeral X25519 keys, including phpseclib's normal SSH exchange path, are not affected. Recovery of the scalar permanently compromises operations that reuse that key. This issue is fixed in versions 3.0.57 and 4.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpseclib/Crypt/EC/Formats/Keys/MontgomeryPrivate.phpto a version that resolves this vulnerability.Fixed in 3.0.57 - Upgrade
Upgrade
phpseclib/Crypt/EC/Formats/Keys/MontgomeryPrivate.phpto a version that resolves this vulnerability.Fixed in 4.0.1 - Operational
Because recovery of the reused X25519 scalar permanently compromises operations that reuse that key, rotate/replace any reused or long-lived X25519 private keys that may have been used with phpseclib’s pure-PHP path prior to 3.0.57 and 4.0.1.
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Exposure requires a reused or long-lived X25519 private key, the corresponding public key, and execution of phpseclib's pure-PHP X25519 path. Ephemeral X25519 keys, including phpseclib's normal SSH exchange path, are not affected.
What attacker access is required to recover a key?
An attacker must be a local observer able to resolve individual Montgomery-ladder steps or libgmp entry-point calls. The timing or libgmp call-count observations must be available while operations use the same private scalar.
Are all key-loading and derivation paths protected by native crypto engines?
No. The MontgomeryPrivate.php derivation path invokes pure-PHP multiplication without a native-engine check, and the PKCS8.php path reaches it when ext-sodium is unavailable.
What should be done if a reused private key may have been exposed?
Update to phpseclib 3.0.57 or 4.0.1. Because recovery permanently compromises operations that reuse the key, replace any potentially exposed reused or long-lived X25519 private keys.