Executive brief
mirage-crypto-ec is a cryptographic library for OCaml that implements elliptic-curve cryptography operations used in TLS, key exchange, and digital signature schemes. A timing side channel in scalar multiplication allows attackers to potentially recover secret keys through precise measurement of operation execution time, compromising the confidentiality of cryptographic material.
Technical details
A timing side channel vulnerability exists in the NIST elliptic-curve scalar multiplication implementation within mirage-crypto-ec versions 0.11.3 through 2.3.0. The vulnerability stems from secret-dependent table lookups in pre-computed tables (introduced in 0.11.3 for performance optimization): the lookup algorithm uses the secret value directly as an array index rather than performing constant-time scanning, causing variable execution time that depends on the secret. This affects Diffie-Hellman key agreement and ECDSA signature generation operations on curves P256, P384, and P521. An attacker with timing measurement capability (e.g., network timing analysis in TLS) can potentially recover secret scalars. The issue was fixed in version 2.4.0 by adopting the constant-time lookup approach used in the Go reference implementation.
Affected products
- OCaml mirage-crypto-ec 0.11.3 through 2.3.0
Timeline
- 2026-08-12: disclosed: Report by Eric Ebinger to security@ocaml.org
- 2026-08-17: patched: Release of mirage-crypto-ec 2.4.0
- 2026-08-17: advisory: Public advisory published
- 2026-09-09: other: CVE-2026-87737 published on NVD