CVE-2026-84308 in phpseclib
Summary
by MITRE • 09/01/2026
phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add() and subtract(). During the Montgomery ladder in phpseclib/Crypt/EC/BaseCurves/Montgomery.php, the reduction behavior of each step depends on the secret scalar prefix, creating per-step timing and libgmp call-count observations that can reveal a reused 251-bit clamped private scalar. The phpseclib/Crypt/EC/Formats/Keys/MontgomeryPrivate.php derivation path invokes the pure-PHP multiplication without a native-engine check, while phpseclib/Crypt/EC/Formats/Keys/PKCS8.php reaches it when ext-sodium is unavailable. Exploitation requires a reused or long-lived X25519 private key, knowledge of the corresponding public key, execution of the pure-PHP path, and a local observer capable of resolving individual ladder steps or libgmp entry-point calls. Ephemeral X25519 keys, including phpseclib's normal SSH exchange path, are not affected. Recovery of the scalar permanently compromises operations that reuse that key. This issue is fixed in versions 3.0.57 and 4.0.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in phpseclib prior to versions 3.0.57 and 4.0.1 represents a critical side-channel attack vector within the implementation of X25519 elliptic curve cryptography. This flaw specifically targets the pure-PHP mathematical engine used for scalar multiplication, which is invoked when native extensions such as ext-sodium are unavailable or during specific key derivation paths like MontgomeryPrivate.php and PKCS8.php. The core technical deficiency lies in the add() and subtract() functions within phpseclib/Math/PrimeField/Integer.php, where data-dependent conditional modular reductions occur. In a secure implementation of elliptic curve operations, particularly those using the Montgomery ladder algorithm found in phpseclib/Crypt/EC/BaseCurves/Montgomery.php, all computational steps should execute with constant time complexity to prevent information leakage through execution timing or resource usage patterns. However, due to these conditional reductions, the behavior and duration of each step in the Montgomery ladder vary depending on the prefix bits of the secret scalar being processed.
This data-dependent variability creates a measurable side channel that allows an attacker to infer details about the private key. Specifically, an observer with local access who can monitor system-level metrics such as CPU timing or library call counts for libgmp operations can distinguish between different execution paths taken during the ladder steps. By analyzing these per-step variations over multiple executions of the same cryptographic operation, it is possible to reconstruct the reused 251-bit clamped private scalar associated with an X25519 key pair. This type of attack aligns closely with CWE-367, which describes Time-of-check to time-of-use (TOCTOU) and related timing side-channel vulnerabilities where implementation details leak sensitive information through observable system behavior rather than logical flaws in the cryptographic algorithm itself.
The operational impact of this vulnerability is severe but contingent upon specific conditions being met by an adversary. Exploitation requires that the target application reuses a long-lived X25519 private key or employs ephemeral keys across multiple sessions without proper isolation, allowing for statistical analysis over many observations. The attacker must also possess knowledge of the corresponding public key and have access to the execution environment sufficient to resolve individual ladder steps or monitor libgmp entry-point calls with high precision. It is crucial to note that this vulnerability does not affect ephemeral X25519 keys, including those used in phpseclib's standard SSH exchange path where new keys are generated for each session, thereby limiting the scope of potential compromise to systems relying on static or long-term key reuse within environments lacking native cryptographic acceleration.
Recovery of the private scalar through this side-channel permanently compromises any security operations that depend on the confidentiality of that specific X25519 key pair. This includes encrypted communications, authentication mechanisms, and digital signatures generated using the compromised key. To mitigate this risk, organizations must ensure they are running phpseclib version 3.0.57 or later, where the mathematical engine has been updated to eliminate these data-dependent conditional branches in favor of constant-time implementations. Additionally, deploying native cryptographic extensions such as ext-sodium is strongly recommended, as these libraries typically utilize hardware-accelerated and side-channel resistant algorithms that do not suffer from the pure-PHP implementation flaws described here. Regular key rotation policies should also be enforced to minimize the window of opportunity for an attacker to gather sufficient data points for successful reconstruction of the private scalar.