[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4CC7C148-7BCC-4D6D-88D0-ED2BADD124BF@schaltsekun.de>
Date: Wed, 08 Jun 2016 21:52:51 +0200
From: Roman Drahtmueller <draht@...altsekun.de>
To: oss-security@...ts.openwall.com,Marcus Meissner <meissner@...e.de>
Subject: Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations
Hi Marcus,
> Hi,
>
> the openssl team usually announces those LOW issues together with the
> other
> issues during their semi regular advisories.
>
> (And usually as soon as these LOW CVE issues are getting added to git,
> a
> new advisory is not far away.)
>
The only low part here appears to be the number of samples needed for a full recovery.
Are we sure that a "low" rating is justified?
DSA is basically dead, until the constant time switch is flicked. The only countermeasure so far is turning it off.
Thx,
Roman.
--
schaltsekun.de
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
