Executive brief
OpenSSL is a widely used security library that provides encrypted communications for websites and applications. A flaw in how it handles certain cryptographic keys could allow a malicious actor to recover a private security key after several connection attempts. While the impact is serious, the attack is difficult to perform and primarily affects specialized government or enterprise systems using specific older key standards.
Technical details
A vulnerability exists in OpenSSL's EVP_PKEY_derive_set_peer() function when handling DHX (X9.42) peer keys. The implementation performs the subgroup membership check (Y^q ≡ 1 mod p) using the peer's provided 'q' parameter rather than the local key's 'q' parameter, and fails to verify that the two 'q' values match. An attacker can provide a forged 'q' that is a small prime factor of the cofactor. By repeating this process with different small-prime factors and applying the Chinese Remainder Theorem (CRT), the attacker can execute a Lim–Lee small-subgroup-confinement attack to recover the victim's private key. This affects FIPS modules in versions 3.0 through 4.0.
Affected products
- OpenSSL OpenSSL 3.0, 3.4, 3.5, 3.6, 4.0
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
References
- https://github.com/openssl/security/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02
- https://github.com/openssl/security/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb
- https://github.com/openssl/security/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c
- https://github.com/openssl/security/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2
- https://github.com/openssl/security/commit/ca2237ab5615641b662183b077f62c08d75e8070
- https://openssl-library.org/news/secadv/20260609.txt