On targets that do not have a conditional move/select operations, LLVM compiles the internal conditional sub u32() function, into one that will contain a conditional jump on secret-dependent data, which could leak information about encapsulation and signing keys.

conditional sub u32() is used throughout the field arithmetic of both ML-KEM and ML-DSA.

The variable-time jumps have been observed for ML-KEM and ML-DSA on:

Additionally, ML-DSA sees the vulnerable LLVM optimization on x86 64-unknown-linux-gnu, for hazardous::dsa::mldsa44 and hazardous::dsa::mldsa87.

The leakage this LLVM optimization introduces could enable recovery of cryptographic secrets. The practicality of exploiting the leakage depends on the compiler, target CPU used and how "close" to the process using the vulnerable functions the attacker is.

Upgrade to v0.17.16 or v0.18.1. conditional sub u32() has been re-written to take conditional-move/jump ops availability into account.