Listen to this Post
The vulnerability is a timing side-channel in the Decompose algorithm used during ML-DSA signing for hint generation. It stems from the use of a hardware division instruction (UDIV/SDIV) with data-dependent timing behavior. The decompose function computes r1.0 / TwoGamma2::U32, where r1.0 is derived from secret key material such as components s2 and t0. This division occurs within high_bits() and low_bits() functions during signing, processing values from (&w – &cs2).low_bits() and Hint::new(). Since hardware division execution time varies based on operand values, an attacker with precise timing measurements can observe these variations to infer information about the secret key. The original code directly used variable-time division on secret-derived data, creating a side-channel that could lead to full key extraction over multiple signatures.
Platform: ML-DSA
Version: Not specified
Vulnerability: Timing side-channel
Severity: Critical
Date: Not specified
Prediction: Patch available immediately
What Undercode Say:
Analytics:
Use constant-time analyzer to examine assembly ct-analyzer --instruction=UDIV,SDEV ./ml-dsa-binary Check for data-dependent timing in compiled code
// Original vulnerable code in decompose: r1.0 /= TwoGamma2::U32; // Variable-time division // Mitigated code using Barrett reduction: let quotient = (x64 Self::CT_DIV_MULTIPLIER) >> Self::CT_DIV_SHIFT;
How Exploit:
Timing analysis attacks
Measure division operation durations
Correlate with secret key
Protection from this CVE:
Use constant-time Barrett reduction
Precompute multiplicative inverses
Replace hardware division instructions
Impact:
Secret key leakage
Signature compromise
Cryptographic system breach
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
