{"id":"GHSA-pffg-92cg-xf5c","aliases":["GO-2023-2101"],"status":"published","title":"gnark-crypto's exponentiation in the pairing target group GT using GLV can give incorrect results","description":"### Impact\nWhen the exponent is bigger than `r`, the group order of the pairing target group `GT`, the exponentiation à la GLV (`ExpGLV`) can *sometimes* give incorrect results compared to normal exponentiation (`Exp`). \n\nThe issue impacts all users using `ExpGLV` for exponentiations in `GT`. This does not impact `Exp` and `ExpCyclotomic` which are sound. Also note that GLV methods in G1 and G2 are sound and _not_ impacted.\n\n### Patches\nFix has been implemented in pull request https://github.com/Consensys/gnark-crypto/pull/451 and merged in commit https://github.com/Consensys/gnark-crypto/commit/ec6be1a037f7c496d595c541a8a8d31c47bcfa3d to master branch.\n\nThe fix increased the bounds of the sub-scalars by 1. In fact, since https://github.com/Consensys/gnark-crypto/pull/213, we use a fast scalar decomposition that tradeoffs divisions (needed in the Babai rounding) by right-shifts. We precompute `b=2^m*v/d (m \u003e log2(d))` and then at runtime compute `scalar*b/2^m` (`v` is a lattice vector and `d` the lattice determinant). This increases the bounds on sub-scalars by 1 which we check at runtime before increasing the loop size (we don't target constant-timeness). `m` is chosen to be a machine word twice big than `log2(d)` so that we rarely need to increase the loop size. Hence why the issue happens only *sometimes* if we omit to increase the bounds. This bounds increase was implemented in G1 and G2 but forgot in GT.\n\n### Workarounds\nUpdating to `v0.12.1+`. Alternatively, use `Exp` or `ExpCyclotomic` instead. We are not aware of any users using `ExpGLV` anyway.\n\n### References\n- Fix PR: https://github.com/Consensys/gnark-crypto/pull/451 \n- Fast scalar decomposition PR: https://github.com/Consensys/gnark-crypto/pull/213\n- https://eprint.iacr.org/2015/565 Sec.4.2\n\n### Acknowledgement\nThe vulnerability was reported by [Antonio Sanso](https://github.com/asanso) @ [EF](https://crypto.ethereum.org/).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-10-05T20:57:20Z","modified":"2024-05-20T21:55:42Z","fixes":[{"ecosystem":"Go","package":"github.com/consensys/gnark-crypto","fixed_in":["0.12.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/consensys/gnark-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.12.0"},{"fixed":"0.12.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/consensys/gnark-crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.12.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/consensys/gnark-crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.12.1"}]}]}],"references":[{"url":"https://github.com/Consensys/gnark-crypto/security/advisories/GHSA-pffg-92cg-xf5c","tags":["web"]},{"url":"https://github.com/Consensys/gnark-crypto/pull/213","tags":["web","fix"]},{"url":"https://github.com/Consensys/gnark-crypto/pull/451","tags":["web","fix"]},{"url":"https://github.com/Consensys/gnark-crypto/commit/ec6be1a037f7c496d595c541a8a8d31c47bcfa3d","tags":["web","fix"]},{"url":"https://eprint.iacr.org/2015/565","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pffg-92cg-xf5c","tags":["advisory"]},{"url":"https://github.com/Consensys/gnark-crypto","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-pffg-92cg-xf5c","title":"gnark-crypto's exponentiation in the pairing target group GT using GLV can give incorrect results","description":"### Impact\nWhen the exponent is bigger than `r`, the group order of the pairing target group `GT`, the exponentiation à la GLV (`ExpGLV`) can *sometimes* give incorrect results compared to normal exponentiation (`Exp`). \n\nThe issue impacts all users using `ExpGLV` for exponentiations in `GT`. This does not impact `Exp` and `ExpCyclotomic` which are sound. Also note that GLV methods in G1 and G2 are sound and _not_ impacted.\n\n### Patches\nFix has been implemented in pull request https://github.com/Consensys/gnark-crypto/pull/451 and merged in commit https://github.com/Consensys/gnark-crypto/commit/ec6be1a037f7c496d595c541a8a8d31c47bcfa3d to master branch.\n\nThe fix increased the bounds of the sub-scalars by 1. In fact, since https://github.com/Consensys/gnark-crypto/pull/213, we use a fast scalar decomposition that tradeoffs divisions (needed in the Babai rounding) by right-shifts. We precompute `b=2^m*v/d (m \u003e log2(d))` and then at runtime compute `scalar*b/2^m` (`v` is a lattice vector and `d` the lattice determinant). This increases the bounds on sub-scalars by 1 which we check at runtime before increasing the loop size (we don't target constant-timeness). `m` is chosen to be a machine word twice big than `log2(d)` so that we rarely need to increase the loop size. Hence why the issue happens only *sometimes* if we omit to increase the bounds. This bounds increase was implemented in G1 and G2 but forgot in GT.\n\n### Workarounds\nUpdating to `v0.12.1+`. Alternatively, use `Exp` or `ExpCyclotomic` instead. We are not aware of any users using `ExpGLV` anyway.\n\n### References\n- Fix PR: https://github.com/Consensys/gnark-crypto/pull/451 \n- Fast scalar decomposition PR: https://github.com/Consensys/gnark-crypto/pull/213\n- https://eprint.iacr.org/2015/565 Sec.4.2\n\n### Acknowledgement\nThe vulnerability was reported by [Antonio Sanso](https://github.com/asanso) @ [EF](https://crypto.ethereum.org/).\n","status":"published","published":"2023-10-05T20:57:20Z","modified":"2023-11-08T18:36:33Z","updated_at":"2026-11-02T14:37:17.64478Z"}],"osv":[{"id":"GHSA-pffg-92cg-xf5c","title":"gnark-crypto's exponentiation in the pairing target group GT using GLV can give incorrect results","description":"### Impact\nWhen the exponent is bigger than `r`, the group order of the pairing target group `GT`, the exponentiation à la GLV (`ExpGLV`) can *sometimes* give incorrect results compared to normal exponentiation (`Exp`). \n\nThe issue impacts all users using `ExpGLV` for exponentiations in `GT`. This does not impact `Exp` and `ExpCyclotomic` which are sound. Also note that GLV methods in G1 and G2 are sound and _not_ impacted.\n\n### Patches\nFix has been implemented in pull request https://github.com/Consensys/gnark-crypto/pull/451 and merged in commit https://github.com/Consensys/gnark-crypto/commit/ec6be1a037f7c496d595c541a8a8d31c47bcfa3d to master branch.\n\nThe fix increased the bounds of the sub-scalars by 1. In fact, since https://github.com/Consensys/gnark-crypto/pull/213, we use a fast scalar decomposition that tradeoffs divisions (needed in the Babai rounding) by right-shifts. We precompute `b=2^m*v/d (m \u003e log2(d))` and then at runtime compute `scalar*b/2^m` (`v` is a lattice vector and `d` the lattice determinant). This increases the bounds on sub-scalars by 1 which we check at runtime before increasing the loop size (we don't target constant-timeness). `m` is chosen to be a machine word twice big than `log2(d)` so that we rarely need to increase the loop size. Hence why the issue happens only *sometimes* if we omit to increase the bounds. This bounds increase was implemented in G1 and G2 but forgot in GT.\n\n### Workarounds\nUpdating to `v0.12.1+`. Alternatively, use `Exp` or `ExpCyclotomic` instead. We are not aware of any users using `ExpGLV` anyway.\n\n### References\n- Fix PR: https://github.com/Consensys/gnark-crypto/pull/451 \n- Fast scalar decomposition PR: https://github.com/Consensys/gnark-crypto/pull/213\n- https://eprint.iacr.org/2015/565 Sec.4.2\n\n### Acknowledgement\nThe vulnerability was reported by [Antonio Sanso](https://github.com/asanso) @ [EF](https://crypto.ethereum.org/).\n","status":"published","published":"2023-10-05T20:57:20Z","modified":"2024-05-20T21:55:42Z","updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"GO-2023-2101","title":"Incorrect exponentiation results in github.com/consensys/gnark-crypto","description":"Incorrect exponentiation results in github.com/consensys/gnark-crypto","status":"published","published":"2023-10-09T21:30:15Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}