projects / oweals / openssl.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 415c335) | patch
Timing vulnerability in DSA signature generation (CVE-2018-0734).
authorPauli <paul.dale@oracle.com>
Tue, 23 Oct 2018 21:42:46 +0000 (07:42 +1000)
committerPauli <paul.dale@oracle.com>
Sun, 28 Oct 2018 21:46:20 +0000 (07:46 +1000)
commita9cfb8c2aa7254a4aa6a1716909e3f8cb78049b6
treee766b22987a1ec9afb9ee4fc47048bf5bcbe9589tree | snapshot
parent415c33563528667868c3c653a612e6fc8736fd79commit | diff
Timing vulnerability in DSA signature generation (CVE-2018-0734).

Avoid a timing attack that leaks information via a side channel that
triggers when a BN is resized.  Increasing the size of the BNs
prior to doing anything with them suppresses the attack.

Thanks due to Samuel Weiser for finding and locating this.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/7486)
crypto/dsa/dsa_ossl.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.