RUSTSEC-2025-0144

Timing side-channel in ML-DSA decomposition

Reported

December 12, 2025

Issued

January 27, 2026

Package

ml-dsa (crates.io)

Type

Vulnerability

Categories

crypto-failure

Aliases

References

https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7

CVSS Score

6.4 MEDIUM

CVSS Details

Attack Vector: Adjacent
Attack Complexity: High
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: None

CVSS Vector

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Patched

>=0.1.0-rc.3

Description

Summary

A timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature.

Details

The analysis was performed using a constant-time analyzer that examines compiled assembly code for instructions with data-dependent timing behavior. The analyzer flags:

UDIV/SDIV instructions: Hardware division instructions have early termination optimizations where execution time depends on operand values.

The decompose function used a hardware division instruction to compute r1.0 / TwoGamma2::U32. This function is called during signing through high_bits() and low_bits(), which process values derived from secret key components:

(&w - &cs2).low_bits() where cs2 is derived from secret key component s2
Hint::new() calls high_bits() on values derived from secret key component t0

Original Code:

fn decompose<TwoGamma2: Unsigned>(self) -> (Elem, Elem) {
    // ...
    let mut r1 = r_plus - r0;
    r1.0 /= TwoGamma2::U32;  // Variable-time division on secret-derived data
    (r1, r0)
}

Impact

The dividend (r1.0) is derived from secret key material. An attacker with precise timing measurements could extract information about the signing key by observing timing variations in the division operation.

Mitigation

Integer division was replaced with a constant-time Barrett reduction.

Advisory available under CC-BY-4.0 license. Source: https://github.com/RustCrypto/signatures/security/advisories/GHSA-hcp2-x6j4-29j7