Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP2:GA
compat-openssl098.6133
openssl-CVE-2016-7056.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File openssl-CVE-2016-7056.patch of Package compat-openssl098.6133
From 249bcf31405e1622d05ef60dc5e73c54efa64f3c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cesar=20Pereida=20Garc=C3=ADa?= <cesar.pereidagarcia@tut.fi> Date: Fri, 16 Dec 2016 12:02:19 +0200 Subject: [PATCH] ECDSA vulnerable to cache-timing attack. BN_mod_inverse fails to take constant-time path, thus leaking nonce's information. --- crypto/ecdsa/ecs_ossl.c | 2 ++ 1 file changed, 2 insertions(+) Index: openssl-0.9.8j/crypto/ecdsa/ecs_ossl.c =================================================================== --- openssl-0.9.8j.orig/crypto/ecdsa/ecs_ossl.c 2017-02-06 16:57:09.848150903 +0100 +++ openssl-0.9.8j/crypto/ecdsa/ecs_ossl.c 2017-02-06 16:57:25.212383621 +0100 @@ -154,6 +154,7 @@ static int ecdsa_sign_setup(EC_KEY *ecke if (!BN_add(k, k, order)) goto err; #endif /* def(ECDSA_POINT_MUL_NO_CONSTTIME) */ + BN_set_flags(k, BN_FLG_CONSTTIME); /* compute r the x-coordinate of generator * k */ if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) {
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
