---
id: CVE-2026-22705
aliases:
  - RUSTSEC-2025-0144
  - GHSA-hcp2-x6j4-29j7
title: Timing side-channel in ML-DSA decomposition
summary: Timing side-channel in ML-DSA decomposition
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'
vendor: ml-dsa
product: ml-dsa
ecosystem: rust
affected:
  - 'ml-dsa >= 0.0.0-0, < 0.1.0-rc.3'
patched:
  - ml-dsa 0.1.0-rc.3
published: '2025-12-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:13.061349808Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2025-0144'
references:
  - url: 'https://crates.io/crates/ml-dsa'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2025-0144.html'
  - url: 'https://github.com/RustCrypto/signatures/pull/1144'
tags:
  - osv
  - rust
epss: 0.00163
epssPercentile: 0.05024
ingestedAt: '2026-10-13T11:45:30.182Z'
---

## Overview

### Summary

A timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature.

### Details

The analysis was performed using a constant-time analyzer that examines compiled assembly code for instructions with data-dependent timing behavior. The analyzer flags:

- **UDIV/SDIV instructions**: Hardware division instructions have early termination optimizations where execution time depends on operand values.

The `decompose` function used a hardware division instruction to compute `r1.0 / TwoGamma2::U32`. This function is called during signing through `high_bits()` and `low_bits()`, which process values derived from secret key components:

- `(&w - &cs2).low_bits()` where `cs2` is derived from secret key component `s2`
- `Hint::new()` calls `high_bits()` on values derived from secret key component `t0`

**Original Code**:
```rust
fn decompose<TwoGamma2: Unsigned>(self) -> (Elem, Elem) {
    // ...
    let mut r1 = r_plus - r0;
    r1.0 /= TwoGamma2::U32;  // Variable-time division on secret-derived data
    (r1, r0)
}
```

### Impact

The dividend (`r1.0`) is derived from secret key material. An attacker with precise timing measurements could extract information about the signing key by observing timing variations in the division operation.

### Mitigation

Integer division was replaced with a constant-time Barrett reduction.

## Affected packages

- `ml-dsa >= 0.0.0-0, < 0.1.0-rc.3`

## Remediation

Upgrade to a patched release:

- `ml-dsa 0.1.0-rc.3`