Executive brief
jsrsasign is a JavaScript cryptographic library that implements ECDSA (Elliptic Curve Digital Signature Algorithm) for digital signing. A timing side-channel vulnerability named Minerva allows attackers to recover private encryption keys by measuring how long ECDSA signature generation takes, since the computation time depends on the bits of the private key value.
Technical details
The vulnerability is a side-channel timing attack affecting ECDSA signature generation in jsrsasign versions 4.0.0 through 8.0.12. The root cause is that the ECPointFp.multiply() method uses a binary NAF (Non-Adjacent Form) multiplication algorithm whose execution time leaks information about the scalar (private key) bit-length and value. An attacker with access to measure signature generation timing across multiple operations can statistically recover the private key. The attack requires local or adjacent access to observe timing behavior, but does not require authentication or user interaction. The vulnerability is fixed in version 8.0.13 and later by implementing constant-time point multiplication.
Affected products
- kjur jsrsasign 4.0.0 to 8.0.12
Timeline
- 2019-10-03: disclosed: Minerva attack reported in GitHub issue #411
- 2020-06-28: advisory: GHSA-g753-jx37-7xwh published
- 2020-06-30: patched: Fix released in jsrsasign 8.0.13