Loading story…
Researchers demonstrated that remote timing attacks against OpenSSL could recover long-term private keys from general-purpose servers, overturning the assumption that such side channels were only practical against local devices. One line of work showed that OpenSSL 0.9.7 systems using RSA without blinding—including deployments such as Apache mod_ssl and stunnel—leaked enough information during CRT-based decryption to extract a 1024-bit RSA private key with roughly 1 million to 1.4 million queries in about two hours under typical conditions. The leakage stemmed from timing differences tied to Montgomery extra reductions and the choice between Karatsuba and normal multiplication, and the attack was shown to work across processes, virtual machines, and routed campus networks.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
A 2016 USENIX Security paper introduced CacheBleed, a cache-based side-channel attack affecting OpenSSL RSA implementations on Intel processors. The work showed that fine-grained cache-bank conflicts could leak secret-dependent information and enable recovery of RSA private keys despite constant-time countermeasures.
The 2011 research proposed padding the nonce scalar to a fixed bit length before scalar multiplication to eliminate the timing leak in OpenSSL’s ECDSA implementation. The authors reported that the patch blocked the attack with negligible performance overhead.
Billy Bob Brumley and Nicola Tuveri described a practical remote timing side channel in OpenSSL’s Montgomery ladder implementation for binary-field elliptic curves, where nonce bit-length leakage during ECDSA operations could be measured from TLS handshakes. They showed that an attacker could combine timing data and collected signatures with a lattice attack to recover a server’s long-term ECDSA private key.
David Brumley and Dan Boneh showed that remote timing attacks against OpenSSL 0.9.7 without RSA blinding could recover a 1024-bit RSA private key from general-purpose servers, including Apache mod_ssl and stunnel deployments. Their experiments demonstrated feasibility across local processes, virtual machines, and routed campus networks, with key recovery in roughly two hours using about one million to 1.4 million queries.
Following the RSA timing-attack research, OpenSSL later enabled RSA blinding by default as a mitigation against the disclosed side channel. The papers also note that Mozilla NSS and some hardware crypto accelerators already had effective protections in place.
On 2003-03-17, OpenSSL warned that versions 0.9.7a and 0.9.6i were vulnerable to RSA timing attacks when blinding was not enabled, affecting many SSL/TLS deployments such as Apache mod_ssl. The project released a patch to enable RSA blinding by default, advised users to rebuild and reinstall OpenSSL and dependent applications, and noted the issue as CVE candidate CAN-2003-0147.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
8 references tracked. Mallory keeps watching after this page renders.
eprint.iacr.org
Open sourceeprint.iacr.org
Open sourcekb.cert.org
Open sourceopenssl.org
Open sourceeprint.iacr.org
Open sourcecryptodeeptech.ru
Open sourcecrypto.stanford.edu
Open sourceusenix.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenSSL disclosed **CVE-2018-0737**, a low-severity cache-timing side channel in RSA private-key generation affecting versions before `1.0.2p` and `1.1.0i`. Three non-constant-time execution paths, including `BN_gcd`, could leak sensitive state to an attacker able to run a precisely timed cache attack on the same physical system while a key is generated, potentially allowing recovery of the newly generated RSA private key. Researchers demonstrated recovery through the `BN_gcd` path at an approximately 30% success rate across more than 10,000 cluster trials. OpenSSL incorporated fixes into `1.0.2p` and `1.1.0i`, with patches also available through upstream commits `349a41da1` and `6939eab03`. Exploitation requires stringent local or adjacent-system access and observation at the moment of key generation, limiting practical exposure; keys generated and retained in hardware security modules are not affected. Red Hat issued fixes for affected RHEL 7 and later systems and JBoss Core Services products.
Aug 29, 2026
Researchers showed that **ECDSA implementations can fail catastrophically when nonce handling or cryptographic execution leaks even tiny amounts of information**. The *LadderLeak* paper demonstrated private-key recovery from less than one bit of nonce leakage by exploiting side-channel weakness in ECDSA implementations that use the Montgomery ladder, and reported that several OpenSSL versions were vulnerable. The attack combined probabilistic leakage of the nonce’s most significant bit with improved Hidden Number Problem techniques to recover keys on curves including `sect163r1` and `NIST P-192`. Related reporting highlighted broader implementation risk across hardware and software cryptography stacks, including surveys of **deterministic ECDSA per `RFC6979`** in open-source libraries such as **Mbed TLS, GnuTLS, and OpenSSL**, checks for RFC6979 support in smart-card and HSM environments, and a separate report of **memory corruption in the Java Card Runtime Environment (JCRE)** that could affect unpatchable HSM devices and expose private keys. Together, the references show that weak nonce generation, side-channel leakage, and hardware runtime flaws can all undermine ECDSA key protection even when standard cryptographic algorithms are used.
Aug 16, 2026
OpenSSL disclosed **Heartbleed** (`CVE-2014-0160`), a critical flaw in the TLS/DTLS heartbeat extension caused by a missing bounds check that let remote attackers read up to **64 KB** of memory from vulnerable clients and servers. The bug affected OpenSSL `1.0.1` through `1.0.1f` and some `1.0.2-beta` releases, potentially exposing private keys, passwords, cookies, and other sensitive data without leaving reliable forensic traces. OpenSSL urged organizations to upgrade to `1.0.1g` or disable heartbeats if they could not patch immediately, while researchers and vendors warned that remediation also required rotating keys, revoking and reissuing certificates, and resetting passwords only after affected services had been fixed. The vulnerability triggered emergency responses across the Internet and in embedded infrastructure, with Cisco, Juniper, Western Digital, Apple, Android device makers, and major online platforms assessing or patching affected products. Reports showed the risk extended beyond websites to routers, VPNs, storage appliances, mobile devices, and other systems using embedded OpenSSL, while Cloudflare demonstrated that theft of SSL private keys was practically achievable and incident reporting linked the flaw to real-world compromise, including theft of Canadian taxpayer data and suspected corporate intrusions. The incident also exposed a structural weakness in Internet security: one of the web’s most widely trusted cryptographic libraries had been maintained by a small, underfunded team, prompting calls for sustained investment in critical open-source infrastructure.
Jun 29, 2026