Wind Wong

**Name of the Vulnerable Software and Affected Versions** wolfSSL version 5.8.4 **Description** wolfSSL version 5.8.4 on RISC-V RV32I architectures does not have a constant-time software implementation for 64-bit multiplication. The compiler-inserted ` muldi3` subroutine executes in variable time depending on the operand values. This impacts several SP math functions, including `sp 256 mul 9` and `sp 256 sqr 9`, resulting in a timing side-channel that could reveal sensitive cryptographic data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** wolfSSL version 5.8.4 **Description** The software contains a flaw in the constant-time masking logic within the `sp 256 get entry 256 9` function. When compiled with GCC targeting RISC-V RV32I using the -O3 optimization flag, the logic is altered into conditional branches. This change compromises the side-channel resistance of Elliptic Curve Cryptography (ECC) scalar multiplication, potentially enabling a local attacker to retrieve secret keys through timing analysis. **Recommendations** Avoid compiling wolfSSL version 5.8.4 with GCC targeting RISC-V RV32I using the -O3 optimization flag.