In Bouncy Castle for Java before version 1.86, the NTRU implementation used integer division operations on secret values during key generation, encapsulation, and decapsulation. These divisions, specifically in Polynomial.modQ, Polynomial.mod3, and NTRUSampling.mod3, had latency dependent on secret operands, creating a timing side-channel (CWE-208). An attacker measuring these timing differences could potentially recover information about the private key. The fix in version 1.86 replaces these divisions with constant-time masking (for modQ, leveraging q as a power of two) and division-free fold and select operations (for mod3), eliminating the timing discrepancy without changing the cryptographic results.

An attacker capable of measuring timing differences during cryptographic operations involving the NTRU algorithm could gain information about the private key, potentially compromising the confidentiality of the key material. This vulnerability affects the security of cryptographic operations in affected versions of Bouncy Castle for Java, potentially enabling key recovery attacks.

Upgrade to Bouncy Castle for Java version 1.86 or later, where the timing side-channel has been mitigated by replacing secret-dependent division operations with constant-time implementations. No other mitigation is required as the fix is included in the official release.