[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <26073564-c863-4012-b943-295dec9a5111@gmail.com>
Date: Tue, 14 Oct 2025 11:52:17 -0400
From: Demi Marie Obenour <demiobenour@...il.com>
To: oss-security@...ts.openwall.com, Alex Gaynor <alex.gaynor@...il.com>
Subject: Re: BoringSSL private key loading is not constant time
On 10/14/25 10:23, Alex Gaynor wrote:
> I missed this talk at the OpenSSL Conference last week. And I don't
> know what _precise_ claims the BoringSSL folks have made.
>
> But it seems to me any claim like "there are no timing side-channels"
> has to have an implicit "relevant to a threat model". It's _surely_
> the case that many functions in any library exhibit timing
> variability, but if this can't be used to leak anything confidential,
> it's not really an attack of note. In this case, as I understand it,
> the only thing that's alleged to be leaked is the length of a key,
> which already wasn't confidential.
It appears to be the number of trailing zero bytes in an elliptic
curve secret key. That lets an attacker narrow the search space,
but that is all.
> Alex
>
> On Mon, Oct 13, 2025 at 11:07 PM Peter Gutmann
> <pgut001@...auckland.ac.nz> wrote:
>>
>> Jeffrey Walton <noloader@...il.com> writes:
>>
>>> What does the attacker learn besides the key length? Isn't that mostly
>>> public information, like the TLS options used during cipher suite
>>> negotiation?
>>
>> It's a proof-of-concept from a very entertaining talk at the OpenSSL
>> conference, "Constant-Time BIGNUM Is Bollocks". The BoringSSL folks had
>> claimed there were no timing side-channels in their code, this demonstrates a
>> timing side-channel.
>>
>> Admittedly not a terribly useful one :-).
>>
>> Peter.
>
>
>
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Download attachment "OpenPGP_0xB288B55FFF9C22C1.asc" of type "application/pgp-keys" (7141 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
