CVE-2025-7396

In wolfSSL release 5.8.2 blinding support is turned on by default for Curve25519 in applicable builds. The blinding configure option is only for the base C implementation of Curve25519. It is not needed, or available with; ARM assembly builds, Intel assembly builds, and the small Curve25519 feature. While the side-channel attack on extracting a private key would be very difficult to execute in practice, enabling blinding provides an additional layer of protection for devices that may be more susceptible to physical access or side-channel observation.

In wolfSSL release 5.8.2 blinding support is turned on by default for Curve25519 in applicable builds. The blinding configure option is only for the base C implementation of Curve25519. It is not needed, or available with; ARM assembly builds, Intel assembly builds, and the small Curve25519 feature. While the side-channel attack on extracting a private key would be very difficult to execute in practice, enabling blinding provides an additional layer of protection for devices that may be more susceptible to physical access or side-channel observation.

En la versión 5.8.2 de wolfSSL, la compatibilidad con el cegamiento está activada por defecto para Curve25519 en las compilaciones aplicables. La opción de configuración de cegamiento solo está disponible para la implementación básica de Curve25519 en C. No es necesaria ni está disponible con compilaciones de ensamblaje ARM, compilaciones de ensamblaje Intel ni con la función pequeña de Curve25519. Si bien el ataque de canal lateral para extraer una clave privada sería muy difícil de ejecutar en la práctica, habilitar el cegamiento proporciona una capa adicional de protección para dispositivos que podrían ser más susceptibles al acceso físico o a la observación de canal lateral.