CVE-2020-10932

Vulnerability

Arm Mbed TLS versions before 2.16.6 and 2.7.x before 2.7.15 contain a side-channel vulnerability in the implementation of ECDSA signatures. When converting the projective coordinates of the scalar multiplication result to affine coordinates, the conversion leaks timing or other side-channel information. An attacker who can obtain precise enough side-channel measurements can reconstruct the projective coordinate of the result. This information, combined with the classic Naccache–Smart–Stern attack (see reference [1]) to recover a few bits of the ephemeral scalar, and a lattice attack, allows full recovery of the long-term ECDSA private key.

Exploitation

An attacker must be able to perform many side-channel measurements on the same target device. A typical scenario is when the attacker controls the untrusted operating system in an SGX enclave and the vulnerable code runs inside the enclave. The attacker does not need any special authentication or write access beyond the ability to observe the side channel (e.g., timing or power). The steps are: (1) measure the side channel during multiple ECDSA signing operations; (2) reconstruct the projective coordinate of the scalar multiplication result; (3) apply the Naccache–Smart–Stern method to extract a few bits of the ephemeral nonce from those coordinates; (4) collect enough such partial ephemeral nonces and use a lattice attack to compute the long-term private key.

Impact

Successful exploitation completely compromises the ECDSA private key. The attacker can then forge signatures for any message, impersonate the legitimate key owner, or sign malicious code or updates. The confidentiality, integrity, and authenticity of all communications and data protected by that key are lost. No user interaction beyond the attacker's controlled environment is required.

Mitigation

The vulnerability is fixed in Arm Mbed TLS versions 2.16.6 and 2.7.15, released in 2020. Users should upgrade to these versions or later immediately. No workaround is available for unpatched versions. This CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of publication.