Cloudflare CIRCL Library ECC P384 Curve Incorrect Value Calculation Vulnerability

A vulnerability exists in the Cloudflare CIRCL cryptographic library, specifically in the ECC P384 package, related to the CombinedMult function. This function generates incorrect values for certain inputs on the secp384r1 curve. The issue arises from the use of incomplete addition formulas. However, ECDH and ECDSA signing operations that depend on this curve are not impacted. The vulnerability has been addressed in version 1.6.3.

Impact

The vulnerability leads to incorrect value calculations in elliptic curve operations, which could potentially disrupt cryptographic processes that rely on accurate computations.

Remediation

Users can upgrade to Cloudflare CIRCL version 1.6.3 to address this vulnerability.