# GHSA-R6PH-V2QM-Q3C2

## Summary

pyca/cryptography SECT curve public key parsing lacks subgroup validation, enabling small-subgroup attacks that leak ECDH private key bits and allow ECDSA signature forgery.

## Description

## Summary
cryptography’s public key construction and loading APIs for elliptic curves do not validate that a provided point lies in the expected prime-order subgroup for SECT curves, enabling small-subgroup attacks.

## Details
The functions `public_key_from_numbers` / `EllipticCurvePublicNumbers.public_key()`, `load_der_public_key()`, and `load_pem_public_key()` accept public points without checking subgroup membership. For SECT curves (cofactor > 1), an attacker can supply a point from a small-order subgroup. In ECDH, computing `S = [victim_private_key]P` leaks `victim_private_key mod (small_subgroup_order)` (i.e., least significant bits). In ECDSA, weak public keys in a small subgroup can allow signature forgery on that subgroup.

## Reproduction Steps
> Note: Advisory does not provide a full PoC. The steps below describe a minimal lab approach.
1. Set up a Python environment with a vulnerable version:
   - `pip install "cryptography<=46.0.4"`
2. Generate or obtain an SECT curve public point that lies in a small-order subgroup (cofactor > 1) for a SECT curve.
3. Use one of the affected APIs to load/build the public key without validation:
   - `EllipticCurvePublicNumbers(x, y, curve).public_key()`
   - `load_der_public_key(der_bytes)` or `load_pem_public_key(pem_bytes)`
4. Perform ECDH with the victim private key using the small-order public key, or use the key for ECDSA verification.

## Indicators of Success
- The library accepts the small-subgroup public key without error.
- ECDH computations leak information about the private key modulo the subgroup order.
- ECDSA verification with small-subgroup keys allows forgeries on that subgroup.

## References
- https://github.com/advisories/GHSA-R6PH-V2QM-Q3C2
- https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2
- https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c
- https://github.com/pyca/cryptography/releases/tag/46.0.5