GHSA-346h-749j-r28w: 
PHP vulnerability analysis and mitigation

PHPECC (mdanter/ecc) was found to be vulnerable to multiple cryptographic side-channel attacks. The vulnerability was disclosed on April 25, 2024, and affects all versions from 0.x to 1.0.0. This critical severity vulnerability (CVSS score 9.1) impacts the cryptographic operations of the library, particularly in its ECDSA signature and EcDH implementations (GitHub Advisory).

The vulnerability encompasses three main technical issues: First, the library is vulnerable to malleable ECDSA signature attacks due to improper signature canonicalization. Second, the GMPMath adapter implementation for ECDSA signatures uses the GNU Multiple Precision arithmetic library (GMP), which lacks constant-time implementations. Third, the EcDH implementation contains timing leaks in the scalar-point multiplication operations, despite using a Montgomery ladder, as the add(), mul(), and getDouble() methods on the Point class are not constant-time (GitHub Release).

The vulnerabilities can lead to serious security breaches. An attacker could potentially leak secret numbers and private keys through timing analysis. For ECDSA signatures, studying operation timing could reveal the secret number 'k' and subsequently the private key. In the case of ECDH, private keys can leak information about each bit through timing side-channels. This is particularly critical for cryptocurrency-related projects, which are among the primary users of this library (GitHub Advisory).

The vulnerability can be exploited remotely with low attack complexity and requires no privileges or user interaction. The CVSS base metrics indicate a Network attack vector with low complexity, making it particularly dangerous. The vulnerability has received a Critical severity rating with a CVSS score of 9.1, indicating its serious nature and ease of exploitation (GitHub Advisory).

Users are advised to upgrade to version 2.0.0 of paragonie/ecc, which implements several security fixes. The new version introduces a mechanism for mitigating malleable ECDSA signatures, implements constant-time arithmetic operations, and fixes EcDH timing leaks through a ConstantTimeMath implementation. For migration, users should replace mdanter/ecc or phpecc/phpecc in their composer.json with paragonie/ecc:^2 and ensure that any Signer object instantiation includes the second constructor argument set to true (GitHub Release).