oss-security - BoringSSL private key loading is not constant time

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <fd686bd9-d2a7-89f9-f438-7ed38e127591@iki.fi>
Date: Mon, 13 Oct 2025 04:03:09 -0400 (EDT)
From: Billy Brumley <bbb@....fi>
To: oss-security@...ts.openwall.com
Subject: BoringSSL private key loading is not constant time

Howdy Folks,

I spoke at the OpenSSL Conference in Prague last week, where I stepped 
through the following demo I wrote

https://gitlab.com/platsec/boringssl-keyload-vuln

This was on BoringSSL main HEAD. (At the time, at least.)

Here "constant time" is in the cryptographic sense. Time to load a private 
key should not depend on bits of said key taking certain values, yet it 
does in BoringSSL's implementation. Constant-time crypto code seems to be 
important to BoringSSL / Google.

I'm providing this information (and PoC) to the community in the spirit of 
transparency.

Cheers,

BBB

-- 
Dr. Billy B. Brumley, D.Sc. (Tech.)
Director of Research, ESL Global Cybersecurity Institute (GCI)
Kevin O'Sullivan Endowed Professor, Department of Cybersecurity (CSEC)
Director, Platform Security Laboratory (PLATSEC)
Rochester Institute of Technology
Cybersecurity Hall 70-1770
100 Lomb Memorial Drive
Rochester, NY, 14623-5608, USA
S/MIME public key: https://people.rit.edu/bbbics/bbbics@rit.edu.crt
S/MIME public key: https://people.rit.edu/bbbics/bbb@iki.fi.crt
https://www.rit.edu/directory/bbbics-billy-brumley
https://www.rit.edu/cybersecurity/
Download attachment "smime.p7s" of type "application/pkcs7-signature" (1537 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.