Description

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add() and subtract(). During the Montgomery ladder in phpseclib/Crypt/EC/BaseCurves/Montgomery.php, the reduction behavior of each step depends on the secret scalar prefix, creating per-step timing and libgmp call-count observations that can reveal a reused 251-bit clamped private scalar. The phpseclib/Crypt/EC/Formats/Keys/MontgomeryPrivate.php derivation path invokes the pure-PHP multiplication without a native-engine check, while phpseclib/Crypt/EC/Formats/Keys/PKCS8.php reaches it when ext-sodium is unavailable. Exploitation requires a reused or long-lived X25519 private key, knowledge of the corresponding public key, execution of the pure-PHP path, and a local observer capable of resolving individual ladder steps or libgmp entry-point calls. Ephemeral X25519 keys, including phpseclib's normal SSH exchange path, are not affected. Recovery of the scalar permanently compromises operations that reuse that key. This issue is fixed in versions 3.0.57 and 4.0.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-01T20:17:24.867Z",
  "pubdate": "2026-09-01T20:17:24.867Z",
  "executiveSummary": "phpseclib versions prior to 3.0.57 and 4.0.1 are vulnerable to a timing side-channel attack during X25519 scalar multiplication.\nThe vulnerability stems from data-dependent conditional modular reductions within the pure-PHP implementation of the Montgomery ladder.\nAn attacker capable of observing per-step timing variations or libgmp function call frequency can recover a reused 251-bit clamped private scalar.\nThe flaw affects long-lived or reused keys, while ephemeral keys (such as those used in standard SSH exchanges) remain secure.\nExploitation requires the victim to use the pure-PHP implementation, which occurs when ext-sodium is unavailable or when specific derivation paths are invoked.\nSuccessful exploitation results in the permanent compromise of the static X25519 private key, allowing for unauthorized decryption or impersonation.\nThis vulnerability highlights the risks associated with non-constant-time cryptographic primitives in pure-PHP libraries.",
  "technicalDetails": "The root cause of this vulnerability is located in phpseclib/Math/PrimeField/Integer.php, where the add() and subtract() methods perform conditional modular reductions based on the input data. During the Montgomery ladder operation in phpseclib/Crypt/EC/BaseCurves/Montgomery.php, these conditional operations are executed based on the state of the secret scalar prefix.\nBecause the reduction logic is not constant-time, the time taken for each step of the Montgomery ladder leaks information regarding the secret scalar bits. Furthermore, because these arithmetic operations rely on libgmp, an observer capable of monitoring libgmp entry-point call counts can correlate specific execution paths with the private key material. The leakage occurs during the scalar multiplication process, which is inadvertently triggered when ext-sodium is missing or when the code path enters the pure-PHP implementation via phpseclib/Crypt/EC/Formats/Keys/MontgomeryPrivate.php or phpseclib/Crypt/EC/Formats/Keys/PKCS8.php.\nTo exploit this, an attacker must be a local observer capable of high-resolution timing or function-call tracing. The attack flow involves: 1) Identifying a target utilizing a reused/long-lived X25519 private key. 2) Ensuring the target environment does not have ext-sodium installed, forcing the use of the vulnerable pure-PHP fallback. 3) Measuring timing differences or libgmp invocation frequency across consecutive Montgomery ladder steps. 4) Applying cryptanalytic techniques to reconstruct the 251-bit clamped scalar bit-by-bit based on the observed variations. Once the private scalar is recovered, the attacker can decrypt past or future traffic encrypted with that specific key or impersonate the key holder in further communications. The reliance on libgmp makes the vulnerability particularly susceptible to side-channel analysis, as the function calls themselves serve as side-channel signals that bypass high-level timing obfuscation. The impact is significant for applications that utilize static key material for long-term X25519 operations."
}