Listen to this Post
The CVE in `curve25519-dalek` arises from timing variability in the `Scalar29::sub` and `Scalar52::sub` operations. These functions handle elliptic curve scalar arithmetic but fail to maintain constant-time execution due to LLVM optimizations. Attackers exploiting this could perform timing side-channel attacks to infer sensitive cryptographic material. The issue was patched in version 4.1.3, which enforces constant-time execution by preventing unwanted compiler optimizations.
DailyCVE Form
Platform: Rust
Version: <4.1.3
Vulnerability: Timing side-channel
Severity: Low
Date: Jul 27, 2025
Prediction: Patch expected Jul 28, 2025
What Undercode Say
git clone https://github.com/dalek-cryptography/curve25519-dalek cd curve25519-dalek git checkout tags/4.1.3 cargo build --release
How Exploit
Timing analysis of `Scalar29::sub` leaks secrets.
Protection from this CVE
Upgrade to 4.1.3.
Impact
Cryptographic key leakage.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
