[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.BSF.2.00.1410070224500.13577@aneurin.horsfall.org>
Date: Tue, 7 Oct 2014 02:30:22 +1100 (EST)
From: Dave Horsfall <dave@...sfall.org>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: Re: OpenSSL RSA 1024 bits implementation broken?
On Mon, 6 Oct 2014, Pierre Schweitzer wrote:
> There appear to have some noise on the Internet regarding a possible
> flaw in the 1024 bits RSA implementation in OpenSSL which would allow
> bruteforcing the private key in ~20 minutes.
>
> Does anyone has any information about this? The associated pastebin to
> the said information is: http://pastebin.com/D8itq6Ff Is this serious?
On the moderated crypto list where I hang out, it's receiving much
attention. The consensus is that it's likely a buggy compiler or
optimiser that rounded integer division upwards instead of truncating it
as required by the C standard, and that the "discoverer", by refusing to
provide further details, is full of it.
You may be able to search the archives at cryptography@...zdowd.com; as I
said it's a moderated list, but full of techie people who really know
their onions.
-- Dave
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
