In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term private key can recover that key. These are the KyberSlash1 (Poly.toMsg) and KyberSlash2 (ciphertext compression) divisions.
Compression performed during encapsulation operates on values that become the public ciphertext and is not affected.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://github.com/bcgit/bc-java/commit/1590247178f2280defa36421475f015175dfbe9e
91579145-5d7b-4cc5-b925-a0262ff19630
https://github.com/bcgit/bc-java/commit/5adb2c5c5b462a332b01a012bea0784b40b904e5
91579145-5d7b-4cc5-b925-a0262ff19630
https://github.com/bcgit/bc-java/wiki/CVE-2024-14041
91579145-5d7b-4cc5-b925-a0262ff19630
https://kyberslash.cr.yp.to/
91579145-5d7b-4cc5-b925-a0262ff19630