[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ae42a693-c165-33c6-8942-18f8911bcb24@johannes-bauer.com>
Date: Thu, 22 Mar 2018 13:09:29 +0100
From: zugtprgfwprz@...rnkuller.de
To: oss-security@...ts.openwall.com
Subject: Re: OpenSSL: bug in modular exponentiation
Hi Guido,
On 20.03.2018 22:34, Guido Vranken wrote:
> My bignum fuzzer (https://github.com/guidovranken/bignum-fuzzer)
> running on Google's oss-fuzz recently found a bug in affecting
> constant-time modular exponentiation.
Interesting -- could you confirm that the effect of this bug is a
miscalculation? Or is it breaking the constant-time assertion?
> OpenSSL does not treat this as a security vulnerability. This is a
> heads-up to developers who rely on the affected code so they can
> review the impact on their applications on a case-by-case basis.
Do you have a pointer as to where this was discussed? Do you consider it
a security vulnerability? Can you give advice to developers of how to
mitigate this kind of issue?
Is it regarded a WONTFIX by OpenSSL or is it going to be fixed (just not
treated as security-criticial)? If so, do you know the fix version?
Cheers and best regards,
Johannes
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
