add mirage-crypto-ec advisory

advisories/2026/OSEC-2026-17.md

@@ -0,0 +1,48 @@
+```
+id: OSEC-2026-17
+modified: "2026-08-17T09:45:00Z"
+published: "2026-08-17T09:45:00Z"
+severity: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
+severity_score: "5.9 (Medium)"
+affected: "mirage-crypto-ec" {>= "0.11.3" & < "2.4.0"}
+events: [
+  [
+    git "https://github.com/mirage/mirage-crypto" [
+      [fixed "1a61aeee7f593ec067612df1739ec905eab0450f"]
+    ]
+  ]
+]
+credits: [
+  [reporter "Eric Ebinger"]
+  [coordinator "Hannes Mehnert"]
+  [remediation_reviewer "Virgile Robles"]
+  [remediation_developer "Eric Ebinger"]
+]
+cwe: [ CWE-208 ]
+affected_bindings: [
+  "Mirage_crypto_ec.P256.Dh.share"
+  "Mirage_crypto_ec.P256.Dsa.generate"
+  "Mirage_crypto_ec.P256.Dsa.sign"
+  "Mirage_crypto_ec.P256.Dsa.pub_of_priv"
+  "Mirage_crypto_ec.P384.Dh.share"
+  "Mirage_crypto_ec.P384.Dsa.generate"
+  "Mirage_crypto_ec.P384.Dsa.sign"
+  "Mirage_crypto_ec.P384.Dsa.pub_of_priv"
+  "Mirage_crypto_ec.P521.Dh.share"
+  "Mirage_crypto_ec.P521.Dsa.generate"
+  "Mirage_crypto_ec.P521.Dsa.sign"
+  "Mirage_crypto_ec.P521.Dsa.pub_of_priv"
+ ]
+```
+
+# Timing leak in NIST elliptic curves scalar multiplication
+
+The scalar multiplication includes pre-computed tables for speedup (introduced in mirage-crypto-ec 0.11.3). The lookup algorithm for these tables performs secret-dependent reads instead of scanning the entire table.
+
+## Solution
+
+Instead of using the index `n - 1`, where `n` is secret-dependent, use `i - 1`, as done in the Go reference implementation. If `n` is 0, there is a out-of-bounds read before the patch.
+
+## Timeline
+- 2026-08-12: report by Eric Ebinger to security@ocaml.org
+- 2026-08-17: release of mirage-crypto-ec 2.4.0 and this advisory