The vulnerability arises from improper input validation in the DHAgreement.CalculateAgreement function of bc-csharp versions prior to 2.7.0. Specifically, the method fails to apply range and subgroup-membership checks to the ephemeral public keys used in the MTI/A0 two-pass Diffie-Hellman protocol. An attacker can send crafted out-of-range or small-order ephemeral values, causing the local party to compute an agreed key value already known to the attacker, thus defeating the intended key authentication. Furthermore, this flaw enables a malicious peer to learn the local static private key modulo small factors of p-1, and potentially recover the entire private key in groups with many such factors. This vulnerability is limited to applications that invoke DHAgreement directly.

An attacker positioned on the communication path can manipulate the key agreement process to compute a shared secret known to them, effectively breaking the key authentication guarantees of the MTI/A0 Diffie-Hellman protocol. This compromises the confidentiality and integrity of the key exchange. Additionally, the attacker can extract partial or full information about the local static private key, undermining long-term key security. This could lead to further cryptographic attacks or impersonation. The vulnerability does not affect applications that do not call DHAgreement directly.

A fixed version 2.7.0 of bc-csharp is available that addresses this vulnerability by properly validating input values in DHAgreement.CalculateAgreement. Users should upgrade to version 2.7.0 or later to remediate this issue. Until upgraded, avoid using DHAgreement directly or implement strict input validation and subgroup membership checks on ephemeral public keys to mitigate the risk.