Ciphertext decryption via RSA OAEP timing oracle

Timing side channel in Trusted Computing Group TPM 2.0 reference code through revision 184 allows local users to decrypt RSA ciphertexts. Its RSA OAEP padding validation runs in input-dependent time, so repeated adaptively chosen decryption requests expose a Manger padding oracle that recovers plaintext. Exploitation requires elevated local access to the TPM command interface and knowledge of device timing; recovered credentials, import blobs, or session salts can expose private key material and support forged TPM attestations.