Re: http://www.openssl.org/news/secadv_20060905.txt

Mike Tancsa wrote:
Does anyone know the practicality of this attack ? i.e. is this trivial
to do ?

I'm as surprised by this as you are -- usually I get advance warning about
upcoming OpenSSL issues via vendor-sec -- but on first glance it looks like
this attack is indeed trivial.

Also, it looks like the attack isn't limited to keys with a public exponent
of 3; unless I misunderstand the bug, it affects small exponents generally.
An exponent of 17 on a 4096-bit key is almost certainly vulnerable; beyond
that I would need to read the ASN code to confirm.

Keys with a public exponent of 65537 are absolutely not vulnerable to this
attack.

Colin Percival
_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: A basic cryptanalysis question
    ... >> appear out of his attack, he assumes he's recovered the plaintext. ... >include the keys in your construction. ... such a function look at my second order bijective compression of english ...
    (sci.crypt)
  • Re: how secure is SSL?
    ... Most SSL protocols in practice are using 1024-bit RSA keys. ... Untrusted code is another, extra huge problem. ... the number of linearly independent equations. ... Well, if this particular attack is flawed, I don't know. ...
    (sci.crypt)
  • Re: [Full-disclosure] Firewire Attack on Windows Vista
    ... shorten the window of attack for a specific type of user but it's mostly ... Microsoft claims that hibernate mode clears the cryptographic keys from ... my point was _not_ that in a very specific configuration you're ...
    (Bugtraq)
  • Re: Security Flaw in Popular Disk Encryption Technologies
    ... does that mean that geli properly wipes keys from RAM when a laptop is turned off? ... This attack has to be defended against in hardware; it exploits a 'feature' of modern day RAM chips, which can not be controlled by software. ... As encrypted volumes simply require keys to be in memory to be able to use the volumes, the encryption software is vulnerable to this attack. ...
    (freebsd-hackers)
  • Re: Bijective - an explanation please?
    ... I can just reject any key the decrypt the ciphertext to something ... :>dealing with a non-bijective compressor that prepended some 20 or so ... The attack *I* will use is one that rejects all keys ...
    (sci.crypt)