Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <olv_Epzwz4jvQCGNLIBY5Ij1Xizr1uG9HSj2IbgCrP8mqjkxs2s_jD9rz1L_gubdClRr71MOFF6pYj_i-NWiYgwSrlvZLV9cu6CHaBNSm0w=@itk.swiss>
Date: Tue, 12 Jun 2018 16:56:13 -0400
From: Stiepan <stie@....swiss>
To: corsac@...ian.org, oss-security@...ts.openwall.com, marcus.brinkmann@...r-uni-bochum.de
Subject: Re : Re: Re : Re: CVE-2018-12020 in GnuPG

Hi Yves-Alexis,

Any updates on this?

By the way, it might be the occasion to switch to more future-proof signatures, such as
https://datatracker.ietf.org/doc/rfc8391 , which are reputed as quantum-safe and do not depend on some hardness assumptions.
We could help with an open-source implem. if needed.
Apparently, NIST is also moving into that direction for software signatures, according to information given now at ETSI's security week.

Best regards,
Stiepan A. Kovac
President
itk AVtobvS SARL

Envoyé depuis ProtonMail mobile

-------- Message d'origine --------
On 10 juin 2018 à 18:38, Yves-Alexis Perez a écrit :

> On Sun, 2018-06-10 at 10:58 -0400, Stiepan wrote:
>
> Hi Stepian,
>
>> This responsibility discussion is all well and fine, but now that this is
>> half-public, may we know for sure whether we are affected :
>> 1. as debian(-like) package consumers
>
> Not entirely sure what you mean here, but if you're talking about the apt
> package managers (which relies on gpgv for signature verification), it's
> currently investigated.
>
> Note that all supported suites have had their gnupg version updated: https://s
> ecurity-tracker.debian.org/tracker/CVE-2018-12020
>
> Regards,
> --
> Yves-Alexis

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.