RUSTSEC-2025-0144: Timing side-channel in ML-DSA decomposition

What to do

1. See which version you have: cargo tree -i ml-dsa (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p ml-dsa. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example ml-dsa = "0.1.0-rc.3") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Summary

A timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature.

Details

The analysis was performed using a constant-time analyzer that examines compiled assembly code for instructions with data-dependent timing behavior. The analyzer flags:

• **UDIV/SDIV instructions**: Hardware division instructions have early termination optimizations where execution time depends on operand values.

The decompose function used a hardware division instruction to compute r1.0 / TwoGamma2::U32. This function is called during signing through high_bits() and low_bits(), which process values derived from secret key components:

• (&w - &cs2).low_bits() where cs2 is derived from secret key component s2
• Hint::new() calls high_bits() on values derived from secret key component t0

**Original Code**:

fn decompose<TwoGamma2: Unsigned>(self) -> (Elem, Elem) {
    // ...
    let mut r1 = r_plus - r0;
    r1.0 /= TwoGamma2::U32;  // Variable-time division on secret-derived data
    (r1, r0)
}

Impact

The dividend (r1.0) is derived from secret key material. An attacker with precise timing measurements could extract information about the signing key by observing timing variations in the division operation.

Mitigation

Integer division was replaced with a constant-time Barrett reduction.

References

• Package: crates.io/crates/ml-dsa
• Advisory: rustsec.org/advisories/RUSTSEC-2025-0144.html
• Web: github.com/RustCrypto/signatures/pull/1144

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for ml-dsa

• VulnerabilityGHSA-5x2r-hc65-25f9 · 2026-01-28ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices
• VulnerabilityGHSA-h37v-hp6w-2pp8 · 2026-02-02ml-dsa's UseHint function has off by two error when r0 equals zero

Full security history of ml-dsa