[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID:
<ME0P300MB0713AA2595680B38B28287AEEEEAA@ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM>
Date: Mon, 13 Oct 2025 23:12:07 +0000
From: Peter Gutmann <pgut001@...auckland.ac.nz>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: BoringSSL private key loading is not constant time
Jeffrey Walton <noloader@...il.com> writes:
>What does the attacker learn besides the key length? Isn't that mostly
>public information, like the TLS options used during cipher suite
>negotiation?
It's a proof-of-concept from a very entertaining talk at the OpenSSL
conference, "Constant-Time BIGNUM Is Bollocks". The BoringSSL folks had
claimed there were no timing side-channels in their code, this demonstrates a
timing side-channel.
Admittedly not a terribly useful one :-).
Peter.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
