CVE-2026-63569 in bc-csharp
Summary
by MITRE • 10/02/2026
Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is meant to provide. It also allows a malicious peer to learn the local static private key modulo the small factors of p-1, and to recover it entirely in groups with many such factors. The attack uses a crafted out-of-range or small-order ephemeral value, and works because that value is raised to the static private key without the range and subgroup-membership checks applied to DH public keys. Only applications that call DHAgreement directly are affected.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in Legion of the Bouncy Castle Inc.'s bc-csharp library prior to version 2.7.0 represents a critical failure in cryptographic input validation within the Diffie-Hellman key exchange implementation, specifically affecting the MTI/A0 two-pass protocol variant. This flaw stems from an improper handling of ephemeral public keys during the calculation of the shared secret agreement via the DHAgreement.CalculateAgreement method. In standard secure implementations, both static and ephemeral public keys must undergo rigorous validation to ensure they reside within valid subgroups and fall within expected numerical ranges. However, in this affected version, while range and subgroup-membership checks are correctly applied to static private key components or other parts of the exchange, these essential validations are omitted for the incoming ephemeral public key provided by a peer during the handshake process. This asymmetry in validation creates a significant attack surface that undermines the fundamental security guarantees of the Diffie-Hellman protocol.
The operational impact of this vulnerability is severe, as it allows an on-path attacker to compromise the confidentiality and authenticity of communications established using this library. By injecting crafted out-of-range or small-order ephemeral values into the key exchange process, an attacker can force the local party to compute a shared secret that is predictable or already known to the attacker. This effectively defeats the key authentication mechanism provided by MTI/A0, which relies on the secrecy and unpredictability of the derived session keys. Consequently, any data encrypted under this compromised session key becomes susceptible to decryption by the malicious actor who positioned themselves between the communicating parties. The attack exploits the mathematical properties of modular exponentiation where raising a small-order element or an invalid range value to the power of the static private key does not result in uniform distribution across the group, thereby leaking information about the private key itself.
Beyond immediate session compromise, this vulnerability poses a long-term risk to forward secrecy and key integrity through side-channel-like mathematical leakage. A malicious peer can leverage crafted inputs to learn portions of the local party's static private key modulo small factors of p-1, where p is the prime modulus used in the Diffie-Hellman group. In cryptographic groups characterized by many such small factors, this partial information leakage can be aggregated and exploited to recover the entire static private key entirely. This recovery capability means that not only are current sessions compromised, but past communications protected solely by forward secrecy may also be decrypted if the attacker has recorded them, as they possess the long-term static private key required for decryption.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-347 Improper Verification of Cryptographic Signature or MAC in some contexts due to the failure to verify the integrity of the cryptographic parameters exchanged. It also maps closely to MITRE ATT&CK techniques related to Man-in-the-Middle attacks, specifically those involving credential harvesting or session hijacking through weakened encryption protocols. The specific exploitation vector involves manipulating protocol messages to exploit mathematical weaknesses in key derivation functions, which is a common theme in advanced persistent threats targeting cryptographic libraries.
Mitigation for this issue requires an immediate upgrade of the bc-csharp library to version 2.7.0 or later, where the developers have implemented comprehensive validation checks on ephemeral public keys similar to those applied to other components of the key exchange. For applications that cannot immediately update their dependencies due to compatibility constraints, it is crucial to implement additional application-level validation layers before passing any external Diffie-Hellman parameters into the DHAgreement.CalculateAgreement method. These validations should strictly enforce subgroup membership and range checks on all incoming public keys to ensure they are valid elements of the cryptographic group. Furthermore, developers should review their use of direct calls to low-level cryptographic primitives like DHAgreement and consider using higher-level abstractions that encapsulate these security best practices by default, thereby reducing the risk of implementation errors in future development cycles.