CVE-2021-33560: 
NixOS vulnerability analysis and mitigation

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 contains a vulnerability in ElGamal encryption due to missing exponent blinding to address a side-channel attack against mpi_powm, and inappropriate window size selection. This vulnerability affects ElGamal usage in OpenPGP (MITRE, Debian).

The vulnerability stems from two main issues in the ElGamal encryption implementation: lack of exponent blinding and improper window size selection in the mpi_powm operation. The fix was implemented through commit e8b7f10be275 which introduced exponent blinding to mitigate side-channel attacks (GnuPG). The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) (Ubuntu).

A successful exploitation of this vulnerability could allow an attacker to perform side-channel attacks against ElGamal encryption, potentially compromising the confidentiality of encrypted data. This particularly affects systems using ElGamal encryption in OpenPGP implementations (Debian).

The vulnerability requires local access to perform side-channel attacks. While the issue was considered serious enough to warrant patches, the GnuPG team evaluated that when such an attack is possible, easier attacks would likely also be feasible (GnuPG).

The vulnerability has been fixed in Libgcrypt versions 1.8.8 and 1.9.3. Users should upgrade to these or later versions. The fix includes the implementation of exponent blinding for ElGamal encryption. For 1.8.x series, the fix was not initially backported as it was considered a hardening measure rather than a critical security issue (GnuPG).