Vulnerability-Lookup

rustsec-2025-0144

Vulnerability from osv_rustsec

Published

2025-12-12 12:00

Modified

2026-01-27 22:28

Summary

Timing side-channel in ML-DSA decomposition

Details

Summary

A timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature.

Details

The analysis was performed using a constant-time analyzer that examines compiled assembly code for instructions with data-dependent timing behavior. The analyzer flags:

UDIV/SDIV instructions: Hardware division instructions have early termination optimizations where execution time depends on operand values.

The decompose function used a hardware division instruction to compute r1.0 / TwoGamma2::U32. This function is called during signing through high_bits() and low_bits(), which process values derived from secret key components:

(&w - &cs2).low_bits() where cs2 is derived from secret key component s2
Hint::new() calls high_bits() on values derived from secret key component t0

Original Code:

fn decompose<TwoGamma2: Unsigned>(self) -> (Elem, Elem) {
    // ...
    let mut r1 = r_plus - r0;
    r1.0 /= TwoGamma2::U32;  // Variable-time division on secret-derived data
    (r1, r0)
}

Impact

The dividend (r1.0) is derived from secret key material. An attacker with precise timing measurements could extract information about the signing key by observing timing variations in the division operation.

Mitigation

Integer division was replaced with a constant-time Barrett reduction.

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "crypto-failure"
        ],
        "cvss": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "ml-dsa",
        "purl": "pkg:cargo/ml-dsa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.1.0-rc.3"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2026-22705",
    "GHSA-hcp2-x6j4-29j7"
  ],
  "database_specific": {
    "license": "CC-BY-4.0"
  },
  "details": "### Summary\n\nA timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature.\n\n### Details\n\nThe analysis was performed using a constant-time analyzer that examines compiled assembly code for instructions with data-dependent timing behavior. The analyzer flags:\n\n- **UDIV/SDIV instructions**: Hardware division instructions have early termination optimizations where execution time depends on operand values.\n\nThe `decompose` function used a hardware division instruction to compute `r1.0 / TwoGamma2::U32`. This function is called during signing through `high_bits()` and `low_bits()`, which process values derived from secret key components:\n\n- `(\u0026w - \u0026cs2).low_bits()` where `cs2` is derived from secret key component `s2`\n- `Hint::new()` calls `high_bits()` on values derived from secret key component `t0`\n\n**Original Code**:\n```rust\nfn decompose\u003cTwoGamma2: Unsigned\u003e(self) -\u003e (Elem, Elem) {\n    // ...\n    let mut r1 = r_plus - r0;\n    r1.0 /= TwoGamma2::U32;  // Variable-time division on secret-derived data\n    (r1, r0)\n}\n```\n\n### Impact\n\nThe dividend (`r1.0`) is derived from secret key material. An attacker with precise timing measurements could extract information about the signing key by observing timing variations in the division operation.\n\n### Mitigation\n\nInteger division was replaced with a constant-time Barrett reduction.",
  "id": "RUSTSEC-2025-0144",
  "modified": "2026-01-27T22:28:37Z",
  "published": "2025-12-12T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/ml-dsa"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0144.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7"
    }
  ],
  "related": [],
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Timing side-channel in ML-DSA decomposition"
}

GHSA-HCP2-X6J4-29J7

Vulnerability from github – Published: 2026-01-13 15:10 – Updated: 2026-01-29 03:41

Summary

RustCrypto: Signatures has timing side-channel in ML-DSA decomposition

Details

Summary

A timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature.

Details

The analysis was performed using a constant-time analyzer that examines compiled assembly code for instructions with data-dependent timing behavior. The analyzer flags:

UDIV/SDIV instructions: Hardware division instructions have early termination optimizations where execution time depends on operand values.

(&w - &cs2).low_bits() where cs2 is derived from secret key component s2
Hint::new() calls high_bits() on values derived from secret key component t0

Original Code:

fn decompose<TwoGamma2: Unsigned>(self) -> (Elem, Elem) {
    // ...
    let mut r1 = r_plus - r0;
    r1.0 /= TwoGamma2::U32;  // Variable-time division on secret-derived data
    (r1, r0)
}

PoC

I do not have an exploit written for this, currently.

Impact

Mitigation

Replacing division with constant-time Barrett reduction mitigates this risk. Since TwoGamma2 is a compile-time constant, we precompute the multiplicative inverse:

diff --git a/ml-dsa/src/algebra.rs b/ml-dsa/src/algebra.rs
index 559b68a..bb126ce 100644
--- a/ml-dsa/src/algebra.rs
+++ b/ml-dsa/src/algebra.rs
@@ -54,8 +54,50 @@ pub(crate) trait Decompose {
     fn decompose<TwoGamma2: Unsigned>(self) -> (Elem, Elem);
 }

+/// Constant-time division by a compile-time constant divisor.
+///
+/// This trait provides a constant-time alternative to the hardware division
+/// instruction, which has variable timing based on operand values.
+/// Uses Barrett reduction to compute `x / M` where M is a compile-time constant.
+pub(crate) trait ConstantTimeDiv: Unsigned {
+    /// Bit shift for Barrett reduction, chosen to provide sufficient precision
+    const CT_DIV_SHIFT: usize;
+    /// Precomputed multiplier: ceil(2^SHIFT / M)
+    const CT_DIV_MULTIPLIER: u64;
+
+    /// Perform constant-time division of x by Self::U32
+    /// Requires: x < Q (the field modulus, ~2^23)
+    #[inline(always)]
+    fn ct_div(x: u32) -> u32 {
+        // Barrett reduction: q = (x * MULTIPLIER) >> SHIFT
+        // This gives us floor(x / M) for x < 2^SHIFT / MULTIPLIER * M
+        let x64 = u64::from(x);
+        let quotient = (x64 * Self::CT_DIV_MULTIPLIER) >> Self::CT_DIV_SHIFT;
+        quotient as u32
+    }
+}
+
+impl<M> ConstantTimeDiv for M
+where
+    M: Unsigned,
+{
+    // Use a shift that provides enough precision for the ML-DSA field (Q ~ 2^23)
+    // We need SHIFT > log2(Q) + log2(M) to ensure accuracy
+    // With Q < 2^24 and M < 2^20, SHIFT = 48 is sufficient
+    const CT_DIV_SHIFT: usize = 48;
+
+    // Precompute the multiplier at compile time
+    // We add (M-1) before dividing to get ceiling division, ensuring we never underestimate
+    #[allow(clippy::integer_division_remainder_used)]
+    const CT_DIV_MULTIPLIER: u64 = ((1u64 << Self::CT_DIV_SHIFT) + M::U64 - 1) / M::U64;
+}
+
 impl Decompose for Elem {
     // Algorithm 36 Decompose
+    //
+    // This implementation uses constant-time division to avoid timing side-channels.
+    // The original algorithm used hardware division which has variable timing based
+    // on operand values, potentially leaking secret information during signing.
     fn decompose<TwoGamma2: Unsigned>(self) -> (Elem, Elem) {
         let r_plus = self.clone();
         let r0 = r_plus.mod_plus_minus::<TwoGamma2>();
@@ -63,8 +105,9 @@ impl Decompose for Elem {
         if r_plus - r0 == Elem::new(BaseField::Q - 1) {
             (Elem::new(0), r0 - Elem::new(1))
         } else {
-            let mut r1 = r_plus - r0;
-            r1.0 /= TwoGamma2::U32;
+            let diff = r_plus - r0;
+            // Use constant-time division instead of hardware division
+            let r1 = Elem::new(TwoGamma2::ct_div(diff.0));
             (r1, r0)
         }
     }

See our blog post on how we avoided side-channels in our Go implementation of ML-DSA for more information.

Severity ?

6.4 (Medium)


                  
                    CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "ml-dsa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-22705"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1240"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-13T15:10:03Z",
    "nvd_published_at": "2026-01-10T07:16:03Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature.\n\n### Details\n\nThe analysis was performed using a constant-time analyzer that examines compiled assembly code for instructions with data-dependent timing behavior. The analyzer flags:\n\n- **UDIV/SDIV instructions**: Hardware division instructions have early termination optimizations where execution time depends on operand values.\n\nThe `decompose` function used a hardware division instruction to compute `r1.0 / TwoGamma2::U32`. This function is called during signing through `high_bits()` and `low_bits()`, which process values derived from secret key components:\n\n- `(\u0026w - \u0026cs2).low_bits()` where `cs2` is derived from secret key component `s2`\n- `Hint::new()` calls `high_bits()` on values derived from secret key component `t0`\n\n**Original Code**:\n```rust\nfn decompose\u003cTwoGamma2: Unsigned\u003e(self) -\u003e (Elem, Elem) {\n    // ...\n    let mut r1 = r_plus - r0;\n    r1.0 /= TwoGamma2::U32;  // Variable-time division on secret-derived data\n    (r1, r0)\n}\n```\n\n### PoC\n\nI do not have an exploit written for this, currently.\n\n### Impact\n\nThe dividend (`r1.0`) is derived from secret key material. An attacker with precise timing measurements could extract information about the signing key by observing timing variations in the division operation.\n\n### Mitigation\n\nReplacing division with constant-time Barrett reduction mitigates this risk. Since `TwoGamma2` is a compile-time constant, we precompute the multiplicative inverse:\n\n```patch\ndiff --git a/ml-dsa/src/algebra.rs b/ml-dsa/src/algebra.rs\nindex 559b68a..bb126ce 100644\n--- a/ml-dsa/src/algebra.rs\n+++ b/ml-dsa/src/algebra.rs\n@@ -54,8 +54,50 @@ pub(crate) trait Decompose {\n     fn decompose\u003cTwoGamma2: Unsigned\u003e(self) -\u003e (Elem, Elem);\n }\n \n+/// Constant-time division by a compile-time constant divisor.\n+///\n+/// This trait provides a constant-time alternative to the hardware division\n+/// instruction, which has variable timing based on operand values.\n+/// Uses Barrett reduction to compute `x / M` where M is a compile-time constant.\n+pub(crate) trait ConstantTimeDiv: Unsigned {\n+    /// Bit shift for Barrett reduction, chosen to provide sufficient precision\n+    const CT_DIV_SHIFT: usize;\n+    /// Precomputed multiplier: ceil(2^SHIFT / M)\n+    const CT_DIV_MULTIPLIER: u64;\n+\n+    /// Perform constant-time division of x by Self::U32\n+    /// Requires: x \u003c Q (the field modulus, ~2^23)\n+    #[inline(always)]\n+    fn ct_div(x: u32) -\u003e u32 {\n+        // Barrett reduction: q = (x * MULTIPLIER) \u003e\u003e SHIFT\n+        // This gives us floor(x / M) for x \u003c 2^SHIFT / MULTIPLIER * M\n+        let x64 = u64::from(x);\n+        let quotient = (x64 * Self::CT_DIV_MULTIPLIER) \u003e\u003e Self::CT_DIV_SHIFT;\n+        quotient as u32\n+    }\n+}\n+\n+impl\u003cM\u003e ConstantTimeDiv for M\n+where\n+    M: Unsigned,\n+{\n+    // Use a shift that provides enough precision for the ML-DSA field (Q ~ 2^23)\n+    // We need SHIFT \u003e log2(Q) + log2(M) to ensure accuracy\n+    // With Q \u003c 2^24 and M \u003c 2^20, SHIFT = 48 is sufficient\n+    const CT_DIV_SHIFT: usize = 48;\n+\n+    // Precompute the multiplier at compile time\n+    // We add (M-1) before dividing to get ceiling division, ensuring we never underestimate\n+    #[allow(clippy::integer_division_remainder_used)]\n+    const CT_DIV_MULTIPLIER: u64 = ((1u64 \u003c\u003c Self::CT_DIV_SHIFT) + M::U64 - 1) / M::U64;\n+}\n+\n impl Decompose for Elem {\n     // Algorithm 36 Decompose\n+    //\n+    // This implementation uses constant-time division to avoid timing side-channels.\n+    // The original algorithm used hardware division which has variable timing based\n+    // on operand values, potentially leaking secret information during signing.\n     fn decompose\u003cTwoGamma2: Unsigned\u003e(self) -\u003e (Elem, Elem) {\n         let r_plus = self.clone();\n         let r0 = r_plus.mod_plus_minus::\u003cTwoGamma2\u003e();\n@@ -63,8 +105,9 @@ impl Decompose for Elem {\n         if r_plus - r0 == Elem::new(BaseField::Q - 1) {\n             (Elem::new(0), r0 - Elem::new(1))\n         } else {\n-            let mut r1 = r_plus - r0;\n-            r1.0 /= TwoGamma2::U32;\n+            let diff = r_plus - r0;\n+            // Use constant-time division instead of hardware division\n+            let r1 = Elem::new(TwoGamma2::ct_div(diff.0));\n             (r1, r0)\n         }\n     }\n```\n\nSee our blog post on [how we avoided side-channels in our Go implementation of ML-DSA](https://blog.trailofbits.com/2025/11/14/how-we-avoided-side-channels-in-our-new-post-quantum-go-cryptography-libraries/) for more information.",
  "id": "GHSA-hcp2-x6j4-29j7",
  "modified": "2026-01-29T03:41:14Z",
  "published": "2026-01-13T15:10:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22705"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RustCrypto/signatures/pull/1144"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RustCrypto/signatures/commit/035d9eef98486ecd00a8bf418c7817eb14dd6558"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/RustCrypto/signatures"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0144.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "RustCrypto: Signatures has timing side-channel in ML-DSA decomposition"
}

CVE-2026-22705 (GCVE-0-2026-22705)

Vulnerability from cvelistv5 – Published: 2026-01-10 06:14 – Updated: 2026-01-12 16:43

Title

RustCrypto: Signatures has timing side-channel in ML-DSA decomposition

Summary

RustCrypto: Signatures offers support for digital signatures, which provide authentication of data using public-key cryptography. Prior to version 0.1.0-rc.2, a timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature. This issue has been patched in version 0.1.0-rc.2.

Severity ?

6.4 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-1240 - Use of a Cryptographic Primitive with a Risky Implementation

Assigner

GitHub_M

References

URL

Tags

	https://github.com/RustCrypto/signatures/security…	x_refsource_CONFIRM
	https://github.com/RustCrypto/signatures/pull/1144	x_refsource_MISC
	https://github.com/RustCrypto/signatures/commit/0…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	RustCrypto	signatures	Affected: < 0.1.0-rc.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-12T16:42:51.482698Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-12T16:43:06.463Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "signatures",
          "vendor": "RustCrypto",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.1.0-rc.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RustCrypto: Signatures offers support for digital signatures, which provide authentication of data using public-key cryptography. Prior to version 0.1.0-rc.2, a timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature. This issue has been patched in version 0.1.0-rc.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1240",
              "description": "CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T06:14:20.292Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7"
        },
        {
          "name": "https://github.com/RustCrypto/signatures/pull/1144",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/RustCrypto/signatures/pull/1144"
        },
        {
          "name": "https://github.com/RustCrypto/signatures/commit/035d9eef98486ecd00a8bf418c7817eb14dd6558",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/RustCrypto/signatures/commit/035d9eef98486ecd00a8bf418c7817eb14dd6558"
        }
      ],
      "source": {
        "advisory": "GHSA-hcp2-x6j4-29j7",
        "discovery": "UNKNOWN"
      },
      "title": "RustCrypto: Signatures has timing side-channel in ML-DSA decomposition"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22705",
    "datePublished": "2026-01-10T06:14:20.292Z",
    "dateReserved": "2026-01-08T19:23:09.857Z",
    "dateUpdated": "2026-01-12T16:43:06.463Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

rustsec-2025-0144

Vulnerability from osv_rustsec

Summary

Details

Impact

Mitigation

GHSA-HCP2-X6J4-29J7

Summary

Details

PoC

Impact

Mitigation

CVE-2026-22705 (GCVE-0-2026-22705)

Tags

Sightings

Nomenclature