Date: Wed, 8 Jun 2016 23:24:44 +0300 From: Billy Brumley <bbrumley@...il.com> To: oss-security@...ts.openwall.com Subject: Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations >> Are we sure that a "low" rating is justified? >> DSA is basically dead, until the constant time switch is flicked. The >> only countermeasure so far is turning it off. > > Maybe I should be a little more verbose on this: > 1) attacker recovers the DSA host key. > 2) attacker mitm-attacks client connections to the server and recovers the user's private key by exploiting the vulnerable openssl on the client side > 3) ... > > The same principles apply when the computational burden is reversed for client auth, aren't they? Are you talking about the SSH target? If so, the realistic scenario is a user with legitimate credentials logging into a server to steal the DSA host key locally with cache timings. I don't think client-side enters into the equation for this vuln. You need an active attacker initiating handshakes. That's my 2c -- we didn't consider client-side victim much in this work. If it's the TLS target, you need local access or manage to co-locate in cloud scenarios. Not as realistic as the SSH case IMO. BBB
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.