Mirage crypto ec: Timing leak in NIST elliptic curves scalar multiplication
A timing leak vulnerability exists in the scalar multiplication implementation of NIST elliptic curves in mirage-crypto-ec versions from 0.11.3 up to but not including 2.4.0. The vulnerability arises from secret-dependent table lookups that do not scan the entire pre-computed table, potentially leaking secret information. An out-of-bounds read can also occur if the secret index is zero. The issue was reported on 2026-08-12 and fixed in mirage-crypto-ec 2.4.0 released on 2026-08-17.
AI Analysis
Technical Summary
The mirage-crypto-ec library introduced pre-computed tables for scalar multiplication of NIST elliptic curves starting in version 0.11.3 to improve performance. However, the lookup algorithm for these tables performs secret-dependent reads rather than scanning the entire table, leading to a timing side-channel leak. Additionally, if the secret index is zero, an out-of-bounds read occurs before the patch. The recommended fix is to use an index independent of the secret value, following the approach in the Go reference implementation. This vulnerability affects versions >=0.11.3 and <2.4.0 and was addressed in version 2.4.0.
Potential Impact
This vulnerability allows an attacker to potentially recover secret scalar values used in elliptic curve operations by measuring timing differences during scalar multiplication. The confidentiality of cryptographic keys may be compromised. There is no impact on integrity or availability. No known exploits are reported in the wild.
Mitigation Recommendations
A patch is available in mirage-crypto-ec version 2.4.0 that fixes the timing leak by changing the table lookup method to avoid secret-dependent indexing and prevents out-of-bounds reads. Users should upgrade to version 2.4.0 or later to remediate this vulnerability.
Mirage crypto ec: Timing leak in NIST elliptic curves scalar multiplication
Description
A timing leak vulnerability exists in the scalar multiplication implementation of NIST elliptic curves in mirage-crypto-ec versions from 0.11.3 up to but not including 2.4.0. The vulnerability arises from secret-dependent table lookups that do not scan the entire pre-computed table, potentially leaking secret information. An out-of-bounds read can also occur if the secret index is zero. The issue was reported on 2026-08-12 and fixed in mirage-crypto-ec 2.4.0 released on 2026-08-17.
CVSS v3.1
Score 5.9medium
Affected software
pkg:opam/mirage-crypto-ecRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The mirage-crypto-ec library introduced pre-computed tables for scalar multiplication of NIST elliptic curves starting in version 0.11.3 to improve performance. However, the lookup algorithm for these tables performs secret-dependent reads rather than scanning the entire table, leading to a timing side-channel leak. Additionally, if the secret index is zero, an out-of-bounds read occurs before the patch. The recommended fix is to use an index independent of the secret value, following the approach in the Go reference implementation. This vulnerability affects versions >=0.11.3 and <2.4.0 and was addressed in version 2.4.0.
Potential Impact
This vulnerability allows an attacker to potentially recover secret scalar values used in elliptic curve operations by measuring timing differences during scalar multiplication. The confidentiality of cryptographic keys may be compromised. There is no impact on integrity or availability. No known exploits are reported in the wild.
Mitigation Recommendations
A patch is available in mirage-crypto-ec version 2.4.0 that fixes the timing leak by changing the table lookup method to avoid secret-dependent indexing and prevents out-of-bounds reads. Users should upgrade to version 2.4.0 or later to remediate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- OSEC-2026-17
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["opam"]
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a83336dbf8831d5392a7e65
Added to database: 08/17/2026, 16:14:37 UTC
Last enriched: 08/17/2026, 16:35:54 UTC
Last updated: 08/17/2026, 18:36:49 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.