Secp256K1 Native
Monthly
Timing side-channel in secp256k1-native's native constant-time scalar multiplication (Point#mul and the native scalar_multiply_ct) lets an attacker who can measure operation timing statistically recover bits of a secret scalar such as a private key or nonce - but only when the C extension was built by GCC 14.3.0, 15.1.0, or 15.2.0 at -O2 (the level extconf.rb appends), where the compiler reconstructs the branchless uint256_select mask into a secret-dependent je/jne jump. The flaw is in the compiled binary rather than the source, so source review and ctgrind on a non-reconstructing toolchain miss it; builds with GCC 12.4.0 or earlier (pure bitwise ops) and GCC 13.3.0 (constant-time cmov) are not affected, and the pure-Ruby path is unaffected and separately makes no constant-time claim. Practical exploitation additionally requires a consuming application that multiplies a secret scalar in a timing-observable context such as an online signing oracle plus many repeated measurements; no public exploit code was identified at time of analysis, and version 0.18.0 removes the defect on all tested compilers.
Timing side-channel in secp256k1-native's native constant-time scalar multiplication (Point#mul and the native scalar_multiply_ct) lets an attacker who can measure operation timing statistically recover bits of a secret scalar such as a private key or nonce - but only when the C extension was built by GCC 14.3.0, 15.1.0, or 15.2.0 at -O2 (the level extconf.rb appends), where the compiler reconstructs the branchless uint256_select mask into a secret-dependent je/jne jump. The flaw is in the compiled binary rather than the source, so source review and ctgrind on a non-reconstructing toolchain miss it; builds with GCC 12.4.0 or earlier (pure bitwise ops) and GCC 13.3.0 (constant-time cmov) are not affected, and the pure-Ruby path is unaffected and separately makes no constant-time claim. Practical exploitation additionally requires a consuming application that multiplies a secret scalar in a timing-observable context such as an online signing oracle plus many repeated measurements; no public exploit code was identified at time of analysis, and version 0.18.0 removes the defect on all tested compilers.