Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 8 Jun 2016 23:24:44 +0300
From: Billy Brumley <>
Subject: Re: CVE-2016-2178: OpenSSL DSA follows a non-constant
 time codepath for certain operations

>> Are we sure that a "low" rating is justified?
>> DSA is basically dead, until the constant time switch is flicked. The
>> only countermeasure so far is turning it off.
> Maybe I should be a little more verbose on this:
> 1) attacker recovers the DSA host key.
> 2) attacker mitm-attacks client connections to the server and recovers the user's private key by exploiting the vulnerable openssl on the client side
> 3) ...
> The same principles apply when the computational burden is reversed for client auth, aren't they?

Are you talking about the SSH target?

If so, the realistic scenario is a user with legitimate credentials
logging into a server to steal the DSA host key locally with cache

I don't think client-side enters into the equation for this vuln. You
need an active attacker initiating handshakes. That's my 2c -- we
didn't consider client-side victim much in this work.

If it's the TLS target, you need local access or manage to co-locate
in cloud scenarios. Not as realistic as the SSH case IMO.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.