oss-security - Re: Fixing the XML signature HMAC truncation authentication bypass

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Wed, 15 Jul 2009 03:00:58 +0200
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com
Cc: Florian Weimer <fw@...eb.enyo.de>
Subject: Re: Fixing the XML signature HMAC truncation authentication bypass

On Wednesday 15 July 2009, Robert Buchholz wrote:
> Florian Streibelt's analysis of the GnuTLS code indicated that is
> also vulnerable. 

I misread his analysis. That's what happens when I try reading faster 
than my brain follows. The analysis was for the GnuTLS related code of 
xmlsec. Apologies.


Robert

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.