Executive brief
pyquorum is a cryptographic library used for secret sharing and key management. A vulnerability in its mathematical processing allows an attacker to observe how long certain operations take to complete. By measuring these timing differences, an attacker could potentially recover sensitive cryptographic keys or shared secrets, compromising the security of the data the library is intended to protect.
Technical details
The `mul_mod` function in pyquorum (prior to version 0.2.1) implements modular multiplication using a binary expansion loop. The execution time of this loop is dependent on the Hamming weight of the second operand (the exponent), creating an observable timing side-channel (CWE-208). An attacker capable of measuring the duration of secret-sharing operations, such as through a remote network service, can progressively recover the values of individual shares. This process can eventually lead to the full reconstruction of the protected secret. The issue was addressed by implementing constant-time operations in version 0.2.1.
Affected products
- svvqt pyquorum < 0.2.1
Timeline
- 2026-04-27: patched: Fix committed to repository.
- 2026-04-29: disclosed: Initial advisory publication.
- 2026-05-06: advisory: GitHub Advisory published.
- 2026-05-13: other: NVD published.