SM2 signature generation performs variable-time BIGNUM operations on secret nonce and private key values, creating a timing side-channel. This timing discrepancy (CWE-208) allows attackers who can measure signature generation times to infer information about the secret nonce. Accumulating timing data from multiple signatures can lead to private key recovery using lattice-based or Hidden Number Problem attacks. The vulnerability affects all platforms using SM2 signature generation. No patch or remediation information is provided in the source data.

An attacker capable of precisely measuring SM2 signature generation times may extract information about the secret nonce used in each signature. This leakage can be exploited over multiple signatures to recover the private key, compromising the cryptographic security of SM2-based systems. The impact is confidentiality loss of the private key. There is no indication of impact on integrity or availability. The CVSS score of 3.7 reflects a low severity due to the complexity and conditions required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications relying on SM2 signature generation should consider implementing constant-time cryptographic operations or using alternative algorithms not vulnerable to timing side-channels. No vendor advisory or official fix is provided in the current data.