Date: Mon, 12 Aug 2013 18:02:26 +0100 From: Florent Daigniere <florent.daigniere@...stmatta.com> To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: Re: pending Bitcoin/Android CVE assignments On Mon, 2013-08-12 at 12:41 -0400, cve-assign@...re.org wrote: > https://code.google.com/p/bitcoin-wallet/source/detail?name=bitcoinj-0.10&r=04d2044880d88107ee4a939a516fb4be4cedeaf9# That looks like the wrong fix to me. Surely if the assumption is that the application will be used on a large number of heterogeneous embedded devices (with inconsistent software stacks), where random sources are unsuitable for cryptographic usage, the solution should not involve them. Why can't bincoin use deterministic signatures again? https://tools.ietf.org/html/rfc6979 Florent Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.