[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAFRnB2XECXsKDSuvBCeWHwC9apboBdvhYCEFrUo2TuonHs1yFw@mail.gmail.com>
Date: Tue, 14 Oct 2025 10:23:22 -0400
From: Alex Gaynor <alex.gaynor@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: BoringSSL private key loading is not constant time
I missed this talk at the OpenSSL Conference last week. And I don't
know what _precise_ claims the BoringSSL folks have made.
But it seems to me any claim like "there are no timing side-channels"
has to have an implicit "relevant to a threat model". It's _surely_
the case that many functions in any library exhibit timing
variability, but if this can't be used to leak anything confidential,
it's not really an attack of note. In this case, as I understand it,
the only thing that's alleged to be leaked is the length of a key,
which already wasn't confidential.
Alex
On Mon, Oct 13, 2025 at 11:07 PM Peter Gutmann
<pgut001@...auckland.ac.nz> wrote:
>
> Jeffrey Walton <noloader@...il.com> writes:
>
> >What does the attacker learn besides the key length? Isn't that mostly
> >public information, like the TLS options used during cipher suite
> >negotiation?
>
> It's a proof-of-concept from a very entertaining talk at the OpenSSL
> conference, "Constant-Time BIGNUM Is Bollocks". The BoringSSL folks had
> claimed there were no timing side-channels in their code, this demonstrates a
> timing side-channel.
>
> Admittedly not a terribly useful one :-).
>
> Peter.
--
All that is necessary for evil to succeed is for good people to do nothing.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
