FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Timing leaks of the nonce in ECDSA, EdDSA and DSA signatures

Affected packages
	py27-pycryptodome	<	3.24.1
	py27-pycryptodomex	<	3.24.1
	py311-pycryptodome	<	3.24.1
	py311-pycryptodomex	<	3.24.1
	py312-pycryptodome	<	3.24.1
	py312-pycryptodomex	<	3.24.1
	py313-pycryptodome	<	3.24.1
	py313-pycryptodomex	<	3.24.1
	py313t-pycryptodome	<	3.24.1
	py313t-pycryptodomex	<	3.24.1
	py314-pycryptodome	<	3.24.1
	py314-pycryptodomex	<	3.24.1
	py314t-pycryptodome	<	3.24.1
	py314t-pycryptodomex	<	3.24.1
	py315-pycryptodome	<	3.24.1
	py315-pycryptodomex	<	3.24.1

Details

VuXML ID	07e99f22-c176-4c8f-9678-a57ba8114959
Discovery	2026-10-11
Entry	2026-10-12

Helder Eijs reports

Fix timing leaks of the nonce in ECDSA, EdDSA and DSA signatures The signing time depended on the secret nonce, enough to recover the private key with a lattice attack. - EC: scalars are encoded and processed on the full length of the order, and ec_mix_add() is constant time for the point at infinity (a zero digit). - DSA: g^k uses k + q or k + 2q (fixed length) and mpz_powm_sec, or the library's Montgomery exponentiation without GMP. About 40% slower.

[source]

References

URL	https://github.com/Legrandin/pycryptodome/commit/59351474682db6648825f17b11112d6821d66cb9