[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAFeDd5a0aBM-wafxZu7m7NFPcOZyMBV-2ufbiDi_7MLWyqm-Eg@mail.gmail.com>
Date: Wed, 8 Jun 2016 23:24:44 +0300
From: Billy Brumley <bbrumley@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2016-2178: OpenSSL DSA follows a non-constant
time codepath for certain operations
>> Are we sure that a "low" rating is justified?
>> DSA is basically dead, until the constant time switch is flicked. The
>> only countermeasure so far is turning it off.
>
> Maybe I should be a little more verbose on this:
> 1) attacker recovers the DSA host key.
> 2) attacker mitm-attacks client connections to the server and recovers the user's private key by exploiting the vulnerable openssl on the client side
> 3) ...
>
> The same principles apply when the computational burden is reversed for client auth, aren't they?
Are you talking about the SSH target?
If so, the realistic scenario is a user with legitimate credentials
logging into a server to steal the DSA host key locally with cache
timings.
I don't think client-side enters into the equation for this vuln. You
need an active attacker initiating handshakes. That's my 2c -- we
didn't consider client-side victim much in this work.
If it's the TLS target, you need local access or manage to co-locate
in cloud scenarios. Not as realistic as the SSH case IMO.
BBB
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
