pypqc private key retrieval vulnerability
Date: 2024-02
Affected: pip/pypqc
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVSS: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)

### Impact `kyber512`, `kyber768`, and `kyber1024` only: An attacker able to submit many decapsulation requests against a single private key, and to gain timing information about the decapsulation, could recover the private key. Proof-of-concept exploit exists for a local attacker. CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P/RL:O/RC:C ### Patches Version 0.0.6.1 and newer of PyPQC is patched. ### Workarounds No workarounds have been reported. The 0.0.6 -> 0.0.6.1 upgrade should be a drop-in replacement; it has no known breaking changes. ### References #### Timeline 1. Cryspen researchers privately reported KyberSlash to the reference implementation maintainers. 2. Peter Schwabe partially patched KyberSlash \(only "KyberSlash 1"\) in the reference implementation on December 1st, 2023, but did not document or advertise this as a security patch. https://www.github.com/pq-crystals/kyber/commit/dda29cc63af721981ee2c831cf00822e69be3220 3. Daniel J. Bernstein publicly reported KyberSlash as a security issue on December 15th, 2023. https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/hWqFJCucuj4/m/-Z-jm_k9AAAJ 4. Daniel J. Bernstein created a webpage for authoritative reference about KyberSlash on December 19th, 2023. https://kyberslash.cr.yp.to/ 5. Thom Wiggers acknowledged KyberSlash as a security issue on December 19th, 2023. https://www.github.com/PQClean/PQClean/issues/533 6. Prasanna Ravi and Matthias Kannwischer privately reported further


Mitigations:

Architectural layers (MAESTRO):