In Bouncy Castle for Java before version 1.86, the NTRU implementation reduced secret values using the modulo operator (%) in three helper functions. These helpers used integer division whose latency depends on secret operands, leaking timing information. Specifically, Polynomial.modQ performed division by a variable divisor, preventing compiler optimization to constant-time multiplication, and Polynomial.mod3 and NTRUSampling.mod3 divided secret key polynomials and message polynomials during cryptographic operations. An attacker capable of measuring timing differences could potentially recover information about the NTRU private key. The fix replaces these divisions with masking (for modQ, since q is a power of two) and division-free fold and select operations (for mod3), preserving the original results without timing leaks.

The timing side-channel vulnerability allows an attacker with the ability to measure operation latency to gain information about the NTRU private key. This compromises the confidentiality of the private key used in cryptographic operations, potentially undermining the security of key encapsulation and decapsulation processes.

A fix is available in Bouncy Castle for Java version 1.86 and later, which replaces timing-dependent division operations with constant-time masking and division-free implementations. Users should upgrade to version 1.86 or later to mitigate this vulnerability. Patch status is confirmed by the versioning information in the description. No additional mitigations are indicated.