Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 7 Oct 2014 02:30:22 +1100 (EST)
From: Dave Horsfall <dave@...sfall.org>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: Re: OpenSSL RSA 1024 bits implementation broken?

On Mon, 6 Oct 2014, Pierre Schweitzer wrote:

> There appear to have some noise on the Internet regarding a possible 
> flaw in the 1024 bits RSA implementation in OpenSSL which would allow 
> bruteforcing the private key in ~20 minutes.
> 
> Does anyone has any information about this? The associated pastebin to 
> the said information is: http://pastebin.com/D8itq6Ff Is this serious?

On the moderated crypto list where I hang out, it's receiving much 
attention.  The consensus is that it's likely a buggy compiler or 
optimiser that rounded integer division upwards instead of truncating it 
as required by the C standard, and that the "discoverer", by refusing to 
provide further details, is full of it.

You may be able to search the archives at cryptography@...zdowd.com; as I 
said it's a moderated list, but full of techie people who really know 
their onions.

-- Dave

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.