Date: Thu, 2 Jan 2014 14:45:05 -0500 (EST) From: cve-assign@...re.org To: dkg@...thhorseman.net Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, fweimer@...hat.com Subject: Re: kwallet crypto misuse -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thanks very much for this additional information. At this point, it seems very unlikely that the "\0a\0b\0c\0d" issue will have an additional CVE assignment. We were asking just because of the possibility of a clear implementation error in which security was weakened by using a "wrong" character width. > Do you think MITRE or other folks should be recommending pre-whitening > the strings before encrypting them It's possible that a group elsewhere at MITRE would work on recommendations in that area or other areas. For purposes of the CVE assignments in this situation, that type of opportunity for security improvement wasn't being considered. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJSxcEIAAoJEKllVAevmvmsyJoH/R/Z4u6+P/T7Hk3Mj0h1nidp cmG3PUnqQFSzYwWoo3NIst8KTpt1MZQmbAtfTkY3w2hEpqwbQk18pNLzY+lcUFIr wamgvXoyWPOYNcp7NypQfHoRQOT9TdFjhIxJXy9R1VLqfyeubs19uN+iYILDS+ik BgdStB2F1geISFG6M+hO+WtFouk61b5ZaC5ejEjkkEs7U6LQnRcF4WxNmZ3ym2ml zO/kSfpUpzgjMurtRbBFhuh13L2Ohl0nxiizsUv735JH5aL+TX7V8d1B/+11ZXTs RP85J3qyCRYswi0oaCLhOx4Qv/YcUZlCJZIHyTb7seJvJShV6xclQunJD3GFZDU= =YscU -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ