oss-security - Re: CVE-2016-7056 ECDSA P-256 timing attack key recovery (OpenSSL, LibreSSL, BoringSSL)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <6D927636-CDD5-4A48-90F8-3149133ED354@omniti.com>
Date: Tue, 10 Jan 2017 11:17:45 -0500
From: Dan McDonald <danmcd@...iti.com>
To: oss-security@...ts.openwall.com
Cc: Dan McDonald <danmcd@...iti.com>
Subject: Re: CVE-2016-7056 ECDSA P-256 timing attack key
 recovery (OpenSSL, LibreSSL, BoringSSL)


> On Jan 10, 2017, at 10:50 AM, Cesar Pereida Garcia <cesar.pereidagarcia@....fi> wrote:
> 
> Mitigation:
> Users of OpenSSL with the affected versions should apply
> the patch available in the manuscript at [1].

You should just mail the patch to this list.  I'm having a hard time copying/pasting the uuencoded blob from your paper, Cesar.

Thanks,
Dan

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.