Executive brief
phpseclib is a cryptographic library for PHP that provides elliptic curve operations, including X25519 key exchange used in secure communications. The pure-PHP implementation of X25519 scalar multiplication performs variable-time field arithmetic operations whose cost depends on the secret key's values, allowing a local attacker with per-operation observability (via timing or CPU operation counting) to recover the complete private key from as few as 1–32 observations. This breaks the confidentiality of long-lived keys used in protocols like ECDH when certain PHP configurations lack hardware-accelerated sodium or OpenSSL support.
Technical details
phpseclib's Montgomery-ladder X25519 implementation uses non-constant-time field arithmetic in `Math/PrimeField/Integer.php` (methods `add()` at line 189 and `subtract()` at line 207). Each operation performs a data-dependent conditional modular reduction that costs ~0.85–1.0 microseconds on the GMP engine, leaking the count of reductions per ladder step as timing differences (~32 µs per step) or as exactly-determined libgmp call counts (`__gmpz_add` and `__gmpz_sub` entry points). The reduction count per step is a function of the secret scalar's binary prefix, not just the current bit. A beam-search decoder replaying both branches from candidate ladder states can recover the full 251-bit clamped scalar from as few as 1 libgmp call-count observation (20/20 keys) or 32 timing measurements (18–20/20 keys). Exploitation requires: (1) a reused X25519 private key (ephemeral keys are safe), (2) knowledge of the victim's public key to validate decoder output, (3) the pure-PHP path executing (occurs when both ext-sodium and ext-openssl are unavailable or disabled), and (4) per-ladder-step observability via local co-residency (Flush+Reload or libgmp call counting). Patches 3.0.57 and 4.0.1 implement constant-time field arithmetic and gate the vulnerable `MontgomeryPrivate.php:66` path.
Affected products
- phpseclib phpseclib >=3.0.0,<3.0.57 ; >=4.0.0,<4.0.1
Timeline
- 2026-08-26: disclosed: Vulnerability disclosed via GitHub Advisory Database
- 2026-08-26: patched: phpseclib 3.0.57 and 4.0.1 released with fixes
- 2026-09-08: advisory: Published GHSA-q97c-8qh3-fpc6