Timing Attack

wolfssl.native is vulnerable to timing attack. Operations involving a private key such as key generation or signing in ecc.c fails to use a constant-time modular inverse when mapping to affine coordinates, leaking sensitive coordinates when an attacker can take advantage of timing variations in...

Code injection

wolfSSL 4.3.0 has mulmod code in wceccmulmodex in ecc.c that does not properly resist timing side-channel attacks...