[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAH8yC8nZDxYF1NyGjHn8yOADBioNwPB4WTjUZGPmbRTvPLq2tw@mail.gmail.com>
Date: Mon, 13 Oct 2025 14:06:29 -0400
From: Jeffrey Walton <noloader@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: BoringSSL private key loading is not constant time
On Mon, Oct 13, 2025 at 1:25 PM Billy Brumley <bbb@....fi> wrote:
>
> Howdy Folks,
>
> I spoke at the OpenSSL Conference in Prague last week, where I stepped
> through the following demo I wrote
>
> https://gitlab.com/platsec/boringssl-keyload-vuln
>
> This was on BoringSSL main HEAD. (At the time, at least.)
>
> Here "constant time" is in the cryptographic sense. Time to load a private
> key should not depend on bits of said key taking certain values, yet it
> does in BoringSSL's implementation. Constant-time crypto code seems to be
> important to BoringSSL / Google.
Forgive my ignorance... I only visited the forge and read the README
(+1 on the additional terms for DJT).
What does the attacker learn besides the key length? Isn't that
mostly public information, like the TLS options used during cipher
suite negotiation?
Is there an actual private key recovery associated with the attack? I
did not see it in the sources I examined.
And how does one get a server to repeatedly load a private key that is
usually loaded once on server startup?
Finally, how does an attacker change a server's governor, like from
userspace or conservative to performance?
Jeff
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
