Executive Summary

This vulnerability exists in wolfSSL version 5.8.4 running on RISC-V RV32I architectures that lack hardware multiplication instructions. The software uses a compiler-inserted multiplication subroutine (__muldi3) for 64-bit multiplication, which executes in variable time depending on the operand values.

Because the multiplication is not constant-time, it affects several cryptographic functions (such as sp_256_mul_9 and sp_256_sqr_9), creating a timing side-channel. This side-channel can potentially leak sensitive cryptographic data by allowing attackers to infer information based on how long operations take.

Useful 0 Not Useful 0

Impact Analysis

The timing side-channel caused by variable-time 64-bit multiplication can expose sensitive cryptographic data processed by wolfSSL on affected RISC-V RV32I systems.

An attacker with the ability to measure operation timing could exploit this to gain information about cryptographic keys or other secret data, potentially compromising the confidentiality and security of communications or data protected by wolfSSL.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update wolfSSL to version 5.9.0 or later, which includes a patch implementing a constant-time software multiplication function (__muldi3) for RISC-V 32-bit architectures lacking the hardware multiplication extension.

This patch ensures that the multiplication subroutine executes in constant time, preventing timing side-channel leaks of sensitive cryptographic data.

Additionally, ensure that your build environment defines the macro SP_NO_MUL_INSTRUCTION when compiling for RISC-V 32-bit without the multiplication extension to enable the constant-time implementation.

Useful 0 Not Useful 0