CVE-2026-54872: Elliptic Curve Timing Leak Vulnerability

CVE-2026-54872 Overview

CVE-2026-54872 is a timing side-channel vulnerability in OpenSSL affecting Elliptic Curve Digital Signature Algorithm (ECDSA) and SM2 signing operations on curves that lack a dedicated constant-time implementation. The generic elliptic-curve scalar multiplication code pads the secret scalar using non-constant-time BIGNUM operations, causing signing time to depend on the secret nonce value. Applications using Brainpool curves such as brainpoolP384r1 are most affected, along with SM2 signing paths that fall back to the generic implementation. The National Institute of Standards and Technology (NIST) curves P-256, P-384, and P-521 use dedicated constant-time code paths and are not affected. The FIPS provider is not impacted.

Critical Impact
An attacker who can measure signing times across many operations may recover the private key by combining nonce leakage with a lattice-based Hidden Number Problem attack.

Affected Products

OpenSSL ECDSA signing on generic prime curves (for example, Brainpool brainpoolP384r1)
OpenSSL SM2 signing on platforms that use the generic scalar multiplication path
Applications relying on ossl_ec_scalar_mul_ladder() with non-dedicated curves

Discovery Timeline

2026-09-29 - CVE-2026-54872 published to the National Vulnerability Database (NVD)
2026-09-29 - OpenSSL Security Advisory released (OpenSSL Security Advisory)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-54872

Vulnerability Analysis

The vulnerability is classified under [CWE-208] Observable Timing Discrepancy. The generic scalar multiplication routine ossl_ec_scalar_mul_ladder() handles the secret ECDSA or SM2 nonce during signature generation. Before performing the Montgomery ladder, the routine pads the scalar to a fixed length, but the padding path uses BIGNUM operations whose execution time depends on the numeric width of the scalar. Because that width is derived from the secret nonce, the total signing time varies with secret bits.

The leak is small and requires a large number of timing measurements. The effect is largest for curves whose group order lies on a machine-word boundary, such as brainpoolP384r1. Once enough biased nonce samples are collected, an attacker applies a lattice reduction attack against the Hidden Number Problem to recover the private signing key.

Root Cause

Secret scalars are expected to arrive at ossl_ec_scalar_mul_ladder() either flagged with BN_FLG_CONSTTIME or in fixed-top form so their word count is public and value-independent. ECDSA satisfies this via ossl_bn_priv_rand_range_fixed_top(), but the generic SM2 signing path does not. When a scalar arrives without fixed-top width, the subsequent BN_copy() and padding operations execute in variable time, exposing nonce magnitude through observable timing.

Attack Vector

An attacker collects many signature timing measurements from a victim performing ECDSA or SM2 signing on an affected curve. Measurements can be gathered locally or across a network with sufficient precision. After extracting a per-signature timing bias, the attacker feeds the biased nonce samples into a lattice or Hidden Number Problem solver to recover the long-term private key.

/* Patch excerpt: crypto/ec/ec_mult.c
 * Adds fixed-top pinning so scalar padding becomes constant time.
 */
    goto err;
}

/*
 * Constant-timeness of this copy depends on the caller: BN_copy() moves
 * scalar->top words unless |scalar| is flagged BN_FLG_CONSTTIME (in which
 * case scalar->dmax words are moved).  Secret scalars are therefore
 * expected to arrive either BN_FLG_CONSTTIME or fixed-top, so that their
 * top is a public, value-independent width and the copy length does not
 * leak their magnitude.  ECDSA satisfies this via
 * ossl_bn_priv_rand_range_fixed_top(); the generic SM2 signing path does
 * not yet (see the sm2_sig_gen() hardening tracked separately).  The
 * fixed-top pinning below makes the subsequent arithmetic constant time
 * regardless, but cannot retroactively fix the copy length here.
 */
if (!BN_copy(k, scalar)) {
    ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
    goto err;

Source: OpenSSL commit 1a5bee8d

Detection Methods for CVE-2026-54872

Indicators of Compromise

No file-based or network-based indicators exist for this vulnerability. Exploitation is passive timing measurement and leaves no reliable log artifact.
Anomalous, high-frequency signing requests from a single client against an ECDSA or SM2 signing service may indicate a nonce-harvesting campaign.

Detection Strategies

Inventory OpenSSL builds across servers, appliances, and embedded systems, and identify workloads that sign with Brainpool curves or SM2.
Audit application code and TLS configurations for use of brainpoolP256r1, brainpoolP384r1, brainpoolP512r1, or SM2 signing profiles.
Monitor for unusually high volumes of signature operations from a single peer against services performing ECDSA or SM2 signing.

Monitoring Recommendations

Log and rate-limit signing endpoints exposed over the network to reduce the sample size an attacker can collect.
Track OpenSSL library versions in software bill of materials (SBOM) data and flag any host running an unpatched version on affected curves.
Alert on new outbound TLS negotiations that select Brainpool or SM2 curves where they are not expected.

How to Mitigate CVE-2026-54872

Immediate Actions Required

Apply the OpenSSL patched release referenced in the OpenSSL Security Advisory as soon as it is available for your distribution.
Where patching is not immediate, switch signing workloads from Brainpool curves to NIST P-256, P-384, or P-521, which use dedicated constant-time implementations.
Rotate ECDSA and SM2 private keys used with affected curves if you have reason to believe an attacker collected timing measurements.

Patch Information

The fix makes scalar padding in ossl_ec_scalar_mul_ladder() constant time by pinning secret scalars to a fixed-top width before the BN_copy() and subsequent arithmetic. Applied commits include 1a5bee8d, 3f7e1363, 7d83bc77, and 8166827a. The FIPS provider is unaffected because approved NIST curves use dedicated constant-time code.

Workarounds

Disable Brainpool curves in TLS and application configurations until the patch is deployed.
Prefer NIST P-256, P-384, or P-521 for ECDSA signing operations on all affected hosts.
Move SM2 signing workloads to hardware security modules (HSMs) or providers with constant-time implementations.
Restrict network exposure of signing services so remote attackers cannot obtain precise timing samples.

bash

# Example: restrict OpenSSL to constant-time NIST curves in an application config
openssl s_server -groups P-256:P-384:P-521 -cert server.pem -key server.key

# Verify installed OpenSSL version after patching
openssl version -a