CyberRota Analysis
AI-GeneratedBouncy Castle for Java versions 1.73 to before 1.78 contain vulnerabilities in the ML-KEM (CRYSTALS-Kyber) routines, specifically in the polynomial coefficient division processes of Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec. An attacker with the ability to measure timing discrepancies during repeated decapsulations can exploit these weaknesses to recover the long-term private key. Organizations using affected versions of Bouncy Castle should prioritize updating to mitigate potential key recovery risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term private key can recover that key. These are the KyberSlash1 (Poly.toMsg) and KyberSlash2 (ciphertext compression) divisions. Compression performed during encapsulation operates on values that become the public ciphertext and is not affected.
Related CVEs
Other vulnerabilities affecting the same vendor(s)