CVE-2021-33560
HighSummary
Vulnerability in Libgcrypt before versions 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption due to missing exponent blinding, enabling a side-channel attack on mpi_powm. Additionally, the window size is not chosen appropriately, increasing information leakage risk.
Risk Assessment
An attacker can exploit this vulnerability to recover the ElGamal private key through timing or other side-channel observations, compromising the confidentiality of encrypted data, e.g., in OpenPGP implementations.
Recommendation
Immediately upgrade Libgcrypt to version 1.8.8 or later (for 1.8.x branch) or 1.9.3 or later (for 1.9.x branch). After upgrading, regenerate all ElGamal keys.
Other vulnerabilities in Libgcrypt
See all- CVE-2017-0379High
Libgcrypt before version 1.8.1 does not properly consider Curve25519 side-channel attacks, making it easier for attackers to discover a secret key.
- CVE-2026-41989Medium
A vulnerability in Libgcrypt before version 1.12.2 allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext passed to gcry_pk_decrypt.
Original NVD description (English source)
Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.