CVE-2020-26939: Bouncycastle Information Disclosure Flaw

CVE-2020-26939 Overview

A timing-based side channel vulnerability exists in Legion of the Bouncy Castle BC before version 1.61 and BC-FJA before version 1.0.1.2. Attackers can obtain sensitive information about RSA private exponents through observable differences in behavior to error inputs in the OAEP (Optimal Asymmetric Encryption Padding) decoding process. This vulnerability occurs in org.bouncycastle.crypto.encodings.OAEPEncoding.

Critical Impact

Sending specially crafted invalid ciphertext that decrypts to a short payload can cause the OAEP Decoder to throw an early exception, potentially leaking information about the private exponent of the RSA private key. This side channel attack could allow attackers to gradually recover cryptographic key material through repeated attempts.

Affected Products

• Bouncy Castle Legion-of-the-Bouncy-Castle (versions before 1.61)
• Bouncy Castle FIPS Java API (versions before 1.0.1.2)
• Applications using the affected OAEPEncoding class for RSA decryption

Discovery Timeline

• 2020-11-02 - CVE-2020-26939 published to NVD
• 2025-07-17 - Last updated in NVD database

Technical Details for CVE-2020-26939

Vulnerability Analysis

This vulnerability is classified as CWE-203 (Observable Discrepancy), a type of side channel attack that exploits timing differences in cryptographic operations. The flaw exists in how the Bouncy Castle library handles OAEP padding validation during RSA decryption operations.

When an attacker submits carefully crafted invalid ciphertext that results in a short decrypted payload, the OAEP decoder may throw an exception earlier than expected. This timing difference between valid and invalid ciphertext processing creates an observable side channel that can be measured and analyzed by attackers.

By systematically probing the system with various malformed ciphertexts and analyzing the response timing patterns, attackers can incrementally deduce information about the private RSA exponent. This is a classic oracle attack pattern that exploits implementation details rather than cryptographic weaknesses.

Root Cause

The root cause of this vulnerability lies in the non-constant-time error handling within the OAEPEncoding class. When processing decrypted plaintext, the implementation checks the padding structure and throws exceptions at different points in the execution flow depending on the input characteristics. Specifically, when the decrypted payload is unexpectedly short, an exception is raised earlier in the process than when handling other types of invalid input, creating a measurable timing discrepancy.

Attack Vector

The attack requires network access to a service performing RSA-OAEP decryption using vulnerable Bouncy Castle library versions. An attacker does not need authentication or special privileges to exploit this vulnerability.

The exploitation process involves:

1. The attacker identifies a service using RSA-OAEP encryption with a vulnerable Bouncy Castle version
2. The attacker submits numerous carefully crafted invalid ciphertexts to the target service
3. The attacker measures response times or observes exception behavior for each submission
4. By analyzing timing patterns across many requests, the attacker correlates specific ciphertext characteristics with response timing
5. Through statistical analysis of these observations, partial information about the private exponent can be recovered

This attack typically requires a significant number of oracle queries but can be practical against high-availability services that process many decryption requests.

Detection Methods for CVE-2020-26939

Indicators of Compromise

• Unusual patterns of RSA decryption failures with varying error response times
• High volume of decryption requests from single sources with systematically varying ciphertext
• Repeated cryptographic operation failures logged from the org.bouncycastle.crypto.encodings.OAEPEncoding class
• Statistical anomalies in decryption error rates that suggest probing activity

Detection Strategies

• Monitor application logs for elevated rates of OAEP decryption exceptions
• Implement timing analysis on cryptographic endpoints to detect probing patterns
• Deploy intrusion detection rules to identify repeated malformed ciphertext submissions
• Review dependency manifests to identify Bouncy Castle library versions in use across applications

Monitoring Recommendations

• Enable detailed logging for cryptographic operations including timing metrics
• Set up alerts for abnormal patterns in decryption failure rates
• Monitor network traffic for high-frequency requests to RSA decryption endpoints
• Implement rate limiting on cryptographic API endpoints to slow potential oracle attacks

How to Mitigate CVE-2020-26939

Immediate Actions Required

• Upgrade Bouncy Castle BC to version 1.61 or later
• Upgrade Bouncy Castle BC-FJA to version 1.0.1.2 or later
• Audit all applications and services that use Bouncy Castle for RSA-OAEP operations
• Review dependency trees for transitive dependencies on vulnerable versions

Patch Information

The vulnerability has been addressed in Bouncy Castle BC version 1.61 and BC-FJA version 1.0.1.2. The fix implements constant-time processing for OAEP decoding error paths, eliminating the observable timing differences that enabled the information disclosure. For detailed patch information, refer to the GitHub CVE-2020-26939 Advisory.

Workarounds

• Implement rate limiting on services that perform RSA decryption to slow potential oracle attacks
• Add artificial random delays to cryptographic error responses to mask timing variations
• Monitor and block sources exhibiting suspicious patterns of failed decryption attempts
• Consider network-level protections to limit exposure of cryptographic services to untrusted clients

# Maven dependency update example
# Update pom.xml to use patched Bouncy Castle versions
# For BC core library:
# <dependency>
#   <groupId>org.bouncycastle</groupId>
#   <artifactId>bcprov-jdk15on</artifactId>
#   <version>1.61</version>
# </dependency>

# Verify installed version
mvn dependency:tree | grep bouncycastle