bc-csharp: MAC forgery in IesEngine stream mode via length-dependent KDF split
Summary
The bc-csharp cryptography library (BouncyCastle.Cryptography) fails to separate the MAC key from the keystream in the stream mode of IesEngine when the engine is constructed without a block cipher. An attacker who has observed one encrypted message with known plaintext can recover the MAC key and forge shorter messages that the recipient accepts as authentic. Exploitation requires that an application uses IesEngine directly in stream mode with DH or EC Diffie-Hellman; block-cipher mode and the IES/ECIES ciphers from CipherUtilities are not affected.
Affected
- BC C# .NET 2.6.2 and earlier
- BC C# .NET 2.7.0-beta.98 (pre-release)
- Only applications that use IesEngine directly in stream mode
Fixed in
- BC C# .NET 2.7.0 and later
Workaround
- No workaround known beyond the vendor's guidance: move from stream mode to block-cipher mode and avoid stream mode for confidential data.
- Before 2.7.0, report all decryption failures identically in padded block-cipher modes.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- Not listed in CISA KEV.
- No public exploit or proof of concept found.
Our recommendation
- Inventory bc-csharp and BouncyCastle.Cryptography versions in in-house .NET applications and vendor products.
- Upgrade to BC C# .NET 2.7.0 or later.
- Check whether any code constructs IesEngine without a block cipher and, if so, move it to block-cipher mode until patched.
- Ask software vendors whether they use custom IES/ECIES encryption.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-16001 vendor wiki github.com
- Fix commit f881400 github.com
- OSV CVE-2026-16001 osv.dev
- Bouncy Castle C# download page www.bouncycastle.org
- Bouncy Castle C# 2.7.0 release announcement www.bouncycastle.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:34.
Original description (NVD)
Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine (an IesEngine constructed without a block cipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plaintext to forge shorter messages of their choosing that the recipient accepts as authentic, via a crafted ciphertext and MAC tag, because the MAC key was taken from the key derivation output directly after a keystream as long as the message, while the derivation input depends only on the static key pair and fixed parameters. The keystream revealed by that one message therefore contains the MAC key for every sufficiently shorter message.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.