GHSA-rc4p-p3j9-6577: 
Python vulnerability analysis and mitigation

KyberSlash (GHSA-rc4p-p3j9-6577) is a timing vulnerability affecting pypqc versions 0.0.4 through 0.0.6.1. The vulnerability affects the kyber512, kyber768, and kyber1024 implementations, where an attacker can potentially recover the private key by analyzing timing information from decapsulation requests. The issue was discovered in December 2023 and patched in January 2024 (KyberSlash Website, GitHub Advisory).

The vulnerability stems from division operations ('/KYBER_Q') in the message decoding procedure (poly_tomsg) used in decryption and in the compression functions (poly_compress and polyvec_compress) used in encryption. When compiled, these operations may result in variable-time execution depending on the input values, leading to timing side-channels. The vulnerability is split into two parts: KyberSlash1 affecting poly_tomsg and KyberSlash2 affecting poly_compress and polyvec_compress functions (PQC Forum).

An attacker able to submit multiple decapsulation requests against a single private key and measure timing information could potentially recover the private key. The vulnerability is particularly concerning in the re-encryption process of the FO transformed decapsulation procedure, where timing variations can be exploited through maliciously crafted skewed chosen ciphertexts (GitHub Advisory).

The vulnerability has been patched in version 0.0.6.1 of pypqc. The fix involves replacing the vulnerable division operations with constant-time alternatives. Users should upgrade to version 0.0.6.1 or newer, which is a drop-in replacement with no known breaking changes (GitHub Advisory).

The vulnerability was initially discovered by Cryspen researchers and reported privately. The Kyber team implemented patches in multiple stages, with Peter Schwabe first partially patching KyberSlash1 on December 1st, 2023, followed by a complete patch for both KyberSlash1 and KyberSlash2 on December 29th, 2023. The vulnerability has led to significant discussion in the cryptographic community about the importance of constant-time implementations (KyberSlash Website).