From unknown Tue Jun 17 22:20:58 2025 X-Loop: help-debbugs@gnu.org Subject: bug#31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Thu, 14 Jun 2018 19:24:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 31831 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: 31831@debbugs.gnu.org X-Debbugs-Original-To: bug-guix@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.15290042335765 (code B ref -1); Thu, 14 Jun 2018 19:24:02 +0000 Received: (at submit) by debbugs.gnu.org; 14 Jun 2018 19:23:53 +0000 Received: from localhost ([127.0.0.1]:48445 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTXqb-0001Uv-3Y for submit@debbugs.gnu.org; Thu, 14 Jun 2018 15:23:53 -0400 Received: from eggs.gnu.org ([208.118.235.92]:39998) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTXqZ-0001Ui-3y for submit@debbugs.gnu.org; Thu, 14 Jun 2018 15:23:51 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fTXqA-0007ia-Ou for submit@debbugs.gnu.org; Thu, 14 Jun 2018 15:23:45 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:46327) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fTXqA-0007iH-GB for submit@debbugs.gnu.org; Thu, 14 Jun 2018 15:23:26 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58221) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fTXpO-0007gE-OD for bug-guix@gnu.org; Thu, 14 Jun 2018 15:23:26 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fTXp0-0006kK-Hr for bug-guix@gnu.org; Thu, 14 Jun 2018 15:22:37 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:43731) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fTXp0-0006iT-1m for bug-guix@gnu.org; Thu, 14 Jun 2018 15:22:14 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 10C7221398; Thu, 14 Jun 2018 15:22:13 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Thu, 14 Jun 2018 15:22:13 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=content-type:date:from:message-id:mime-version:subject:to :x-me-sender:x-me-sender:x-sasl-enc; s=mesmtp; bh=k0f0koaGOP0rRa X6wbOb/86j9HRpAtLxJRaSQRI12sI=; b=IPrqwGgEqL13uxZHS5g5ADGqHoO+NF /iiIP3J/raeNAaDNBcsmNQcct5pBtlq3wFqEB180xjdulrAEgaLI6uV9kMbcAoDa bSR4fZs0uRLDQP3iyvl7VMCtN6LawE3qI3MEFdo6Y5KIbwgRoVExTK3dUWDtG4T4 ITktBtEJ34B0Q= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; bh=k0f0koaGOP0rRaX6wbOb/86j9HRpAtLxJRaSQRI12sI=; b=kNxYFj/S 6qpFqvveXKXkwyMVD6sxtzMXfA47rZH6uVjY0BfDz8DlrZ6Q+osem4KA5yQ8YmsT 40HXui0d4jKDAkgFw15zxNuu3aoeLYHETf/OWf1bMUnJ9qCsrhujeVcwtONEffLf YYfQ1QZryuVYfIj4yQkKZsD7EuoVZK73QxysDGx2LXFGa4nnYzN7YTxud2POKNjh ELqv+XDPocQ3eZaGdOrL9iX/m2JCCCeerEnJmNQqfvBahR576N0QAfIJjDyPuHjH 0hNrctCtClXFvI5p8IgPRv3RaxD2RfhGCgQCc2U2df1nOAkruxi53r5a0XsKm10W BMfr6e8nXzu+ZQ== X-ME-Proxy: X-ME-Sender: Received: from localhost (c-76-124-202-137.hsd1.pa.comcast.net [76.124.202.137]) by mail.messagingengine.com (Postfix) with ESMTPA id 9CA0E1025C for ; Thu, 14 Jun 2018 15:22:12 -0400 (EDT) Date: Thu, 14 Jun 2018 15:22:11 -0400 From: Leo Famulari Message-ID: <20180614192211.GA21522@jasmine.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="gBBFr7Ir9EOA20Yy" Content-Disposition: inline User-Agent: Mutt/1.10.0 (2018-05-17) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.1 (----) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.1 (-----) --gBBFr7Ir9EOA20Yy Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Recently a new side-channel key extraction technique was published as CVE-2018-0495, and it affects a lot of the cryptographic libraries we package: https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/?style=Cyber+Security An excerpt from that advisory: ------ We analyzed the source code of several open source cryptographic libraries to see if they contain the vulnerable code pattern in the code for ECDSA, DSA, or both. This list is accurate to the best of our knowledge, but it is not exhaustive. Only the first group was affected by this finding; the other three groups are not thought to be vulnerable. Contains vulnerable pattern: CryptLib (Both), LibreSSL (Both), Mozilla NSS (Both), Botan (ECDSA), OpenSSL (ECDSA), WolfCrypt (ECDSA), Libgcrypt (ECDSA), LibTomCrypt (ECDSA), LibSunEC (ECDSA), MatrixSSL (ECDSA), BoringSSL (DSA) Non-constant math, but different pattern: BouncyCastle, Crypto++, Golang crypto/tls, C#/Mono, mbedTLS, Trezor Crypto, Nettle (DSA) Constant time-math: Nettle (ECDSA), BearSSL, Libsecp256k1 Does not implement either: NaCl ------ Note that libtomcrypt is bundled in the Dropbear SSH implementation. I'm going to test the libgcrypt update now. I'd like for other Guix hackers to "claim" an affected package in this thread, and then investigate and test the fixes. Please make new debbugs tickets on guix-patches for each bug-fix patch you propose, and send the links to those tickets here. --gBBFr7Ir9EOA20Yy Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlsiwGMACgkQJkb6MLrK fwgrLBAA5ip/y3YmzlBCH4+BBgI1k/vC62as7GvuB7mLKe58wSP0SAz+ueRz3DEC MrRWN64trNSv5Ei8mAvwFmyNHyEd0KF7vagwPFfZKu+iH2jmOObbJmgPNfO5KyuK rJux+vYBo1u9tcfrkEcyeWvKcwtaVrPNpsc9kD7w9tA8X4sPh0jYq+FJ+izT/poY Ed2I+TLbGH5LKz0OX/6evRzybgW0vhhhrxexP2nfSlmS9xG4UPlUbbZTtzP2N8AH XJI+syV7v3/WWBrseUH39I1kOw0+f6n4fhZHCUHYQ2JKj+QCpebQGuUAcPcnbEIc YkykTNr6Ne2mHjVJNJ4HYdZG3jO/73ltkCvThERsxnY38AaqHbAJ5QCQWNPyjkgS MAbDMauqY3veCprUMl6qJhIrHss2MBGHKTwzUJjcqDGlsY1+B+pcvSFOfSKwLTqs CpU498lJ/HxmTFTa+K1X/+yzK0B1PwSMk1fiYnfbQCdx9IlUr4n0yUa5FmW61E8O gc85KY14GFnq/NoRBJt7RIGm4g6KD1yAn3kqkAd2lEMAY3Vc9dtK78S5qfE4NacI nZ8wGEyF2MwdpbIxRqhXkOzHY7VfEk9ybUjceEw/217SQFamJpx1TpH0Sk49xcIG CG5K2sz1xSSQETPL4YIlmute8mqbLgl6HYCo3AQeCeLsDoeP2oc= =qwNO -----END PGP SIGNATURE----- --gBBFr7Ir9EOA20Yy-- From unknown Tue Jun 17 22:20:58 2025 X-Loop: help-debbugs@gnu.org Subject: bug#31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries References: <20180614192211.GA21522@jasmine.lan> In-Reply-To: <20180614192211.GA21522@jasmine.lan> Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Thu, 14 Jun 2018 19:51:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 31831 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: 31831@debbugs.gnu.org Received: via spool by 31831-submit@debbugs.gnu.org id=B31831.15290058538429 (code B ref 31831); Thu, 14 Jun 2018 19:51:02 +0000 Received: (at 31831) by debbugs.gnu.org; 14 Jun 2018 19:50:53 +0000 Received: from localhost ([127.0.0.1]:48474 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTYGi-0002Bs-Mk for submit@debbugs.gnu.org; Thu, 14 Jun 2018 15:50:52 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:56573) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTYGh-0002Bl-01 for 31831@debbugs.gnu.org; Thu, 14 Jun 2018 15:50:51 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id AE8EC21C4F; Thu, 14 Jun 2018 15:50:50 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute4.internal (MEProxy); Thu, 14 Jun 2018 15:50:50 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=content-type:date:from:message-id:mime-version:subject:to :x-me-sender:x-me-sender:x-sasl-enc; s=mesmtp; bh=zfBKph5LHkMuAT KnpxgqnLUDVD8EIm6csHqNzKzrTbc=; b=KLjFdV2uM8AFHPHWBvUb1ScBwSVuM1 zv+3MHtNvSFKpduZNbyrQW3n46BQkECW3OCjdiRAw+C2bK51RFSNWSGb4uX5fOsC jxpTU/ua/hCAIa5FgRI6SbLzCgqfBE7pG5aZgjYfJvHTjoNDp1o663TnTH2c+lWe S7im7nAJEm5lg= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; bh=zfBKph5LHkMuATKnpxgqnLUDVD8EIm6csHqNzKzrTbc=; b=e3ByQ0rR pRZGll65qQZGK1M8ygy5GkDclUUIB84R9946F5+A2fKyP/jETzmzoYdfN98w178P TIyLcZPeq8Np0mclTa8i3OQO1FYEmenLn+CfPBN0EQYq6bVv9aMO4vFxhi7ICelN HOMQa5lLIkaIkshI2RNuzEvJGDKH1NCefCtIolFqLkIdmEuirgMheqRw/M9CLQzQ QPLLe+qWVJUpsdRjailIEwohW+53AfNFGkQ+Wjwkx9GMdgc4PrUqSShu7rJuEsda MgTb9jycFlgZ4taK5UNtkJW9VWx663z7s6Np/AqdR3gRdFjjiP537nYfJ+WydDDN 4RF+vGjTP0fyvg== X-ME-Proxy: X-ME-Sender: Received: from localhost (c-76-124-202-137.hsd1.pa.comcast.net [76.124.202.137]) by mail.messagingengine.com (Postfix) with ESMTPA id 4DFBFE4919 for <31831@debbugs.gnu.org>; Thu, 14 Jun 2018 15:50:50 -0400 (EDT) Date: Thu, 14 Jun 2018 15:50:49 -0400 From: Leo Famulari Message-ID: <20180614195049.GB4039@jasmine.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="J/dobhs11T7y2rNN" Content-Disposition: inline User-Agent: Mutt/1.10.0 (2018-05-17) X-Spam-Score: -0.7 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) --J/dobhs11T7y2rNN Content-Type: text/plain; charset=us-ascii Content-Disposition: inline I see that Efraim already updated libgcrypt. Awesome, thanks Efraim! I'll try OpenSSL next. --J/dobhs11T7y2rNN Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlsixxkACgkQJkb6MLrK fwieThAAzabMGGFp6vWiDopa26rnClaeMuWJXgas6ozEnUz406XTLvmQlMcO3rq0 TZSBe93u1T6e6PWFu6EhhoxD1HLjWgSddemTBvUTNbOD1X7NiOAsPoyfgwu23ZUx +hn/HG6zlRvxnDy0V2AKQPUmLOb1143uyPdAFG58eBMa8UuIb7q4EYK4CqXNMZOP w9I1ea5nbEcx+cpZ7G40v1BZ2kLe/T9NAfs9U5doyU0NTJz7bOGnGxwvlQKce9Vh sblaQyb2cJc5zN2UCFfRUaPG2KGfpcLKXUNVM0RIbvEav456VyEK5VxaTa/NKDcn K7Ef7JZzUOTU1OTQ0q3N3TVNS+ZiazbFQ5z8WfLkGORoUvqamlV2zT78mgra5LSF j39dOVd5gOp4jwxp8YtePD3zghG9BH+SI0+CciC7Gsmd0tbPQSREjwBrbAyf4JKD 5Mfe6vtf2ugL5S28rgDbLj4R4xxJ24g9OFMSq59qeLJPAfv0T6Ig+hfCALf3F3v4 8oc+j/0dmK2RNOiFSx7yfVRhTSx26oxeL0X0oHdrozlLykfseKM01/uwwtllTv3M 9576u5kP22bkRS6/t8WR9DOg7DSPw8YudecBk94YLP+vW3WfD81q8b5y6q9IFIUF v02N6cIIxk6aK2C0GLv3C7gpZU/dzx58a4u4H2Z2jqSZKHgrdNE= =+auf -----END PGP SIGNATURE----- --J/dobhs11T7y2rNN-- From unknown Tue Jun 17 22:20:58 2025 X-Loop: help-debbugs@gnu.org Subject: bug#31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries Resent-From: =?UTF-8?Q?G=C3=A1bor?= Boskovits Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Thu, 14 Jun 2018 19:54:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 31831 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: Leo Famulari Cc: 31831@debbugs.gnu.org Received: via spool by 31831-submit@debbugs.gnu.org id=B31831.15290060188705 (code B ref 31831); Thu, 14 Jun 2018 19:54:02 +0000 Received: (at 31831) by debbugs.gnu.org; 14 Jun 2018 19:53:38 +0000 Received: from localhost ([127.0.0.1]:48481 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTYJO-0002GK-Dh for submit@debbugs.gnu.org; Thu, 14 Jun 2018 15:53:38 -0400 Received: from mail-it0-f44.google.com ([209.85.214.44]:55118) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTYJM-0002G8-5x for 31831@debbugs.gnu.org; Thu, 14 Jun 2018 15:53:36 -0400 Received: by mail-it0-f44.google.com with SMTP id 76-v6so9866111itx.4 for <31831@debbugs.gnu.org>; Thu, 14 Jun 2018 12:53:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=uDoihNon5Ljlr0YugF4J687qw4DjoDYbKNyhF4YWa38=; b=GNmZQzY0z2BJu/7c/BN/Dy/4Xb1bGnBMujPMyMiGgzGUCf4/Dj/ZpXRFBsbAz/+XH+ w7ErFKqIZVXoS57iCUMYBZUMnurCCkoJJfl1+Zb9bKYso9Nar2kghc49BiyMVP/2hzd6 sX9+op9QQGik7BSInpNN8EstJCfSmh3eQwPZkaomoHzLQvQ8GTeFgiDqODWtWoT9u/Sq 9/KP2l29KlVfZ9n8qsSQCcHu34Iyl//Pu8Ee/urWc2jCLFUoBLfWXleswogC5r+aoYl6 ZYuAZEdvECEXea6cXXyl/lisR3lSFp4A0CiwaUvgyzUEvQPMs1xRQ9LTvfcNgoFw4qCa J/Iw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=uDoihNon5Ljlr0YugF4J687qw4DjoDYbKNyhF4YWa38=; b=ZPAvq+wj06BTwfKEqq4WkqSQU44fK3JU4yi2Mna5RicRW/grQ9kKkbgFxfhBtF6D9i sRfUmLs1D5RecTUNVD0N1o1/ePJNehYqZbu/8MlH1tvPr46PHWhhcN4auNRC6mBENHgL Ge0LM2bOGYh2UvK6GFwNePdh8j/MsQkfWLF2ezY0NOMb0BN5wdlu7O2nkR+O0e6qS4Fb BkRfaO/fswe9DIFO3TaItw9FKVHHwMX/lWBILjW9Vs34ZxRFK5BYpM/I1rBThRGrZ8QT LFfM3EjWeZCPXHF4QWdrubaLGIwL5/N3VmxZTqcuasTRZNHV8kdHYHNjx2VGl7wJOa8n oyOQ== X-Gm-Message-State: APt69E2Tt2V8UYuFLjPnjNK3cJqn6WfSu8ilfiqWnnY5QZ81XonuGXVK t7jBZwDbhxS5vkEBqQUsYflQT80onb+TcBGgj1G/ X-Google-Smtp-Source: ADUXVKL78Dpss97b33vpBYI+W2aJ67Z5HnFmaKazezFxQsZqs8zHLkUcJ3qytHTYMw88UBMscewDP/abLaq8CRUhim4= X-Received: by 2002:a24:50d1:: with SMTP id m200-v6mr3472181itb.11.1529006010576; Thu, 14 Jun 2018 12:53:30 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:a84d:0:0:0:0:0 with HTTP; Thu, 14 Jun 2018 12:53:30 -0700 (PDT) In-Reply-To: <20180614195049.GB4039@jasmine.lan> References: <20180614192211.GA21522@jasmine.lan> <20180614195049.GB4039@jasmine.lan> From: =?UTF-8?Q?G=C3=A1bor?= Boskovits Date: Thu, 14 Jun 2018 21:53:30 +0200 Message-ID: Content-Type: multipart/alternative; boundary="0000000000001eb64d056e9f74e9" X-Spam-Score: 0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --0000000000001eb64d056e9f74e9 Content-Type: text/plain; charset="UTF-8" 2018-06-14 21:50 GMT+02:00 Leo Famulari : > I see that Efraim already updated libgcrypt. Awesome, thanks Efraim! > > I'll try OpenSSL next. > I'll try libressl. --0000000000001eb64d056e9f74e9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
2018= -06-14 21:50 GMT+02:00 Leo Famulari <leo@famulari.name>:
=
I see that Efraim already updated libgcrypt.= Awesome, thanks Efraim!

I'll try OpenSSL next.

I'll try libres= sl.
--0000000000001eb64d056e9f74e9-- From unknown Tue Jun 17 22:20:58 2025 X-Loop: help-debbugs@gnu.org Subject: bug#31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Thu, 14 Jun 2018 20:07:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 31831 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: =?UTF-8?Q?G=C3=A1bor?= Boskovits Cc: 31831@debbugs.gnu.org Received: via spool by 31831-submit@debbugs.gnu.org id=B31831.15290067729959 (code B ref 31831); Thu, 14 Jun 2018 20:07:01 +0000 Received: (at 31831) by debbugs.gnu.org; 14 Jun 2018 20:06:12 +0000 Received: from localhost ([127.0.0.1]:48492 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTYVY-0002aZ-0e for submit@debbugs.gnu.org; Thu, 14 Jun 2018 16:06:12 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:52995) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTYVW-0002aS-IY for 31831@debbugs.gnu.org; Thu, 14 Jun 2018 16:06:11 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 3EFB021A29; Thu, 14 Jun 2018 16:06:10 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Thu, 14 Jun 2018 16:06:10 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=cc:content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= mesmtp; bh=dUJhKpNqm2KW5niqYlsQOLpcuHstaPF8WqrfMgzC1l4=; b=sEPwo eM1dQMQP7aOapYBBXUabW1SrgCdfXGoEnadp+cL/Am+hLIaG8w6Y6qHnpF5PHaIa IE8o6emi4iZ0JvWQnio5Nk0VD86jvNwkGMVS5yhUaQEr+dmqGUZfrUCippKaXb5B 6PZhuS/vEw9UwNcstbOjq/CIiBqcOBolql2RZg= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=dUJhKpNqm2KW5niqYlsQOLpcuHsta PF8WqrfMgzC1l4=; b=T/KMyAA1EbDlE8urKIT3ImOpKYt2E0RT6FfONs8iXOVVJ RdBTPstODErSIll+uUiEmWRCEHQDYUcBtPUDl9W2H7/6lC35qiuChCKWkyd1zVR5 u6p7kGrCxYO2wMTjvKsxyZKSXGSQW590PeYva1amIgCJGiuDbnQSdL/LcuGGCjPK oyNv854bkALTchUzo5PkHJbSFq8y/hjVSnGKtFLLQA2ppIRQhv7ydYyUTd7Vs5y/ 0Hy9h+x37TdHnNybBCWxz24y8XYNCY1lvNd6q0CCtGwFF0094ftC9OCxgKhfYNHx +DGJTDcj/T1mGTqOxqx1i+pCG9uLWtjNukerS8/Gw== X-ME-Proxy: X-ME-Sender: Received: from localhost (c-76-124-202-137.hsd1.pa.comcast.net [76.124.202.137]) by mail.messagingengine.com (Postfix) with ESMTPA id E338510266; Thu, 14 Jun 2018 16:06:09 -0400 (EDT) Date: Thu, 14 Jun 2018 16:06:08 -0400 From: Leo Famulari Message-ID: <20180614200608.GA8617@jasmine.lan> References: <20180614192211.GA21522@jasmine.lan> <20180614195049.GB4039@jasmine.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="LQksG6bCIzRHxTLp" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.0 (2018-05-17) X-Spam-Score: -0.7 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) --LQksG6bCIzRHxTLp Content-Type: text/plain; charset=us-ascii Content-Disposition: inline > 2018-06-14 21:50 GMT+02:00 Leo Famulari : > > I'll try OpenSSL next. They committed a fix but haven't released an update yet: https://github.com/openssl/openssl/commit/a3e9d5aa980f238805970f420adf5e903d35bf09 There is also an unrelated security advisory for a DoS bug from 2 days ago: https://www.openssl.org/news/secadv/20180612.txt I'll try grafting these patches. --LQksG6bCIzRHxTLp Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlsiyrAACgkQJkb6MLrK fwiL6xAAhUiFkoZifXJnnhd8JWO0UJnD856DvXoIWeXsVfVY2IOJH28UQ/LznHsz PrkUi2sJ0X/CsRBLd7GCjxc/lhVVRCBUfz1pQ4Pzg62lqvmaNnZtTLSn8c4kYOGP Yl+/wP7PC4KBRupYecLPjElKFjNG02xbhILrUc7/hKNKNxMBkuezQniPgwjiC9jq apKYFfRaJ+yHEmH6wl1TygowdUsZHFKR9UsJ+tc9B55m1AzA5R/QPBI+kIkTZDKv Lk02msrIGKaheZcfON4PKhLJz8MMT944qA9E24PRiOlwSuOEnCKwkW9RV0hv1hBA RKZTJEFvjInT+nSUV7ZjlM3hrrx14xGaMM8tsK6RCf6ULO30XCkjEnnGkn/pHhzM b51LwSWFNVtJa/W5e343G8p/06GTNYWOFofaAxPOOyxi03s7GQLTr9/W+e/Klo0s sc/f5CRmSUU9KYwUt6V1FB4Pr6u2yPXMrcfzKI8l1i0z3iNEwT0+JW+4BG7N/w2Q yqX6jevzGpAMDwzHLXDC3gV/Z0hWBQUEu6noUEO2gNamt87GFMjwdSGOnOmouoM2 PE2l/7AXjAUI5hWIkeNg3+MaC15crjCGLMwhL2b+H7onJnNnLfOh5l1GMme8qd3r aIjG08bZacT7UOtKwZpxTumoqEETtjXA2OBzcX7n+qH6utMpnUI= =lK6a -----END PGP SIGNATURE----- --LQksG6bCIzRHxTLp-- From unknown Tue Jun 17 22:20:58 2025 X-Loop: help-debbugs@gnu.org Subject: bug#31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries Resent-From: =?UTF-8?Q?G=C3=A1bor?= Boskovits Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Thu, 14 Jun 2018 20:45:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 31831 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: Leo Famulari Cc: 31831@debbugs.gnu.org Received: via spool by 31831-submit@debbugs.gnu.org id=B31831.152900905613546 (code B ref 31831); Thu, 14 Jun 2018 20:45:02 +0000 Received: (at 31831) by debbugs.gnu.org; 14 Jun 2018 20:44:16 +0000 Received: from localhost ([127.0.0.1]:48551 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTZ6N-0003WP-Ua for submit@debbugs.gnu.org; Thu, 14 Jun 2018 16:44:16 -0400 Received: from mail-it0-f51.google.com ([209.85.214.51]:39755) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTZ6M-0003WC-Ez for 31831@debbugs.gnu.org; Thu, 14 Jun 2018 16:44:14 -0400 Received: by mail-it0-f51.google.com with SMTP id p185-v6so121914itp.4 for <31831@debbugs.gnu.org>; Thu, 14 Jun 2018 13:44:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=bQNTApQoh2D4m2Tz6927FYXqw1v095NqfsZpVPSbSe8=; b=vRXWhmB4avxrrB8t6aoA2kHWDo+CavrGn9UNAd2HVGr6P/8moV76+XRpoXc+uCeTwl erjyu8oU0rFVDt7Y8NM3riAgZ6uwG7W6vfWWR3DgIa5NANeXPRccW4l5PPrhKyiw/jKL 8J5xBpf910jDWLVzBN+LPIGoI7nXzdmURHxyGNw/LTbA8vL487sqqBcnH9wcLIYHTtAW 82455tFKvjIC6zqesb3TLmlvNgCfAwlUArp/iSVOvxqVwpImWh55AwFLwWMKLr+At+nx bzxSRU0IHrdxfeKBs9NAkvbxB3pIux8vDMFbapvAiH+klLLPDYSIxwcY7Scp/vYMbrAv 8M1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=bQNTApQoh2D4m2Tz6927FYXqw1v095NqfsZpVPSbSe8=; b=ci7+Mc4JUv8F3gmn5UMUyYmcsHObDrk5CMPRVcZveDcMFyGbi6mlCN5qzAumGswUP3 kx8v4GYaZkT6echQLxWJqTMZG/T73Nsc3ru1AKzJv07RFtwp4xt4xDfRKosj3unlCasg 0DEFfNFH4w94gcfY1yWS5dwff/IftyeOb/ap+JJkkB7q4Z9QaBjs9cgoMK3MHMON5Lxt aICxuwglLq/qS8CBUdalRvbT+iCMP/LmyAez86kAgR7ytystQGMThiClL7Qcjc95EWyl g7LW1P8O/6CCI/QZDl+nzAwRHkWUHM6zQqDtOoFFhhBQ2+fXuM2X3Blsok0D4wi2CTAU YoAw== X-Gm-Message-State: APt69E0V1ikUGyG4YJiemDfzcct/gK6ZR/k2h3ZvlQjZKSvmT5c86C0M QgPD1ipUwitfO3pjuowPg5LgvrZea195WlXVYQ== X-Google-Smtp-Source: ADUXVKLbhP91Xf6NKZOpIkHqcipWXsZ3oV1SIipIp8e9MOTtQu42m60L0mqMMEK3BExU8izhEAn2ytxGyO/FxYIqkf8= X-Received: by 2002:a24:be85:: with SMTP id i127-v6mr3583928itf.131.1529009048948; Thu, 14 Jun 2018 13:44:08 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:a84d:0:0:0:0:0 with HTTP; Thu, 14 Jun 2018 13:44:08 -0700 (PDT) In-Reply-To: References: <20180614192211.GA21522@jasmine.lan> <20180614195049.GB4039@jasmine.lan> From: =?UTF-8?Q?G=C3=A1bor?= Boskovits Date: Thu, 14 Jun 2018 22:44:08 +0200 Message-ID: Content-Type: multipart/alternative; boundary="00000000000038951f056ea02981" X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --00000000000038951f056ea02981 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable 2018-06-14 21:53 GMT+02:00 G=C3=A1bor Boskovits : > 2018-06-14 21:50 GMT+02:00 Leo Famulari : > >> I see that Efraim already updated libgcrypt. Awesome, thanks Efraim! >> >> I'll try OpenSSL next. >> > > I'll try libressl. > Here it is: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D31832 --00000000000038951f056ea02981 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
2018= -06-14 21:53 GMT+02:00 G=C3=A1bor Boskovits <boskovits@gmail.com&g= t;:
2018-06-14 21:50 GMT+02:00 Leo Famulari <leo@famulari.name>= :
I see that Ef= raim already updated libgcrypt. Awesome, thanks Efraim!

I'll try OpenSSL next.

I'll try= libressl.
Here it is:=C2=A0https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D= 31832
--00000000000038951f056ea02981-- From unknown Tue Jun 17 22:20:58 2025 X-Loop: help-debbugs@gnu.org Subject: bug#31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Thu, 14 Jun 2018 20:46:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 31831 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: 31831@debbugs.gnu.org Received: via spool by 31831-submit@debbugs.gnu.org id=B31831.152900914513754 (code B ref 31831); Thu, 14 Jun 2018 20:46:02 +0000 Received: (at 31831) by debbugs.gnu.org; 14 Jun 2018 20:45:45 +0000 Received: from localhost ([127.0.0.1]:48565 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTZ7o-0003Zm-V1 for submit@debbugs.gnu.org; Thu, 14 Jun 2018 16:45:45 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:53893) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTZ7n-0003Ze-2W for 31831@debbugs.gnu.org; Thu, 14 Jun 2018 16:45:43 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 93A8D21C55; Thu, 14 Jun 2018 16:45:42 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Thu, 14 Jun 2018 16:45:42 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= mesmtp; bh=J5p/dlL9JByRPcDBWjG/8+3exjK9jrOHbrTwp0MR3Ak=; b=peqm2 BzNIyojlsu/nvQyNNWikw4iReUGD8IhvrX91XThTae/1Ewp6nPYpc2iAI+27LcJX y8e6x8ouRr0HsMpTwHMAuJqE1gRvjMPXdYTtSUsZEsA8cwrHw0v7tUBrs1MjW9qM GCJ160kPbQJS1XnBnhSH9pzppdS/De9/Fqlu+k= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=J5p/dlL9JByRPcDBWjG/8+3exjK9j rOHbrTwp0MR3Ak=; b=QkfA+zJisJkTaiaStg7fMpcigJmoh7XpJct2iK5WHht+7 kTEN3geRxA8Aqk/wZFSN8vpoDXEkAiLSG9wi3Vn8uX21BCjd9WsGWEvbbw1WJ5G5 ME2Uy6EDva4EQspWIZCNezpEYO7w75uKV4bsnchxxoQFt56QEkNXlKWT4kaqXgjr 8+h3Ur+elv/v+50mP//NA7rH35ofknio8efueaDB0Ez7FCkTscI3dWIgATxsjsup R5KEUAEHTtUgmBsSiY/ecx+xYK67204XmaIdY/g128+XjMXtJoUaNIZtmlC+WMDn sGQj613LYzp4sxtBAcZY//Bc+1YyopGaWaJcDRvoQ== X-ME-Proxy: X-ME-Sender: Received: from localhost (c-76-124-202-137.hsd1.pa.comcast.net [76.124.202.137]) by mail.messagingengine.com (Postfix) with ESMTPA id 44BFD10262 for <31831@debbugs.gnu.org>; Thu, 14 Jun 2018 16:45:42 -0400 (EDT) Date: Thu, 14 Jun 2018 16:45:41 -0400 From: Leo Famulari Message-ID: <20180614204541.GA26976@jasmine.lan> References: <20180614195049.GB4039@jasmine.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="rwEMma7ioTxnRzrJ" Content-Disposition: inline In-Reply-To: <20180614195049.GB4039@jasmine.lan> User-Agent: Mutt/1.10.0 (2018-05-17) X-Spam-Score: -0.7 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) --rwEMma7ioTxnRzrJ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Thu, Jun 14, 2018 at 03:50:49PM -0400, Leo Famulari wrote: > I'll try OpenSSL next. I sent patches for both branches of OpenSSL: version 1.0.2: version 1.1.0: --rwEMma7ioTxnRzrJ Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlsi0/EACgkQJkb6MLrK fwieQQ/9F9/HwOc2YPtHUb5caJ9i3k0Cm5GWph6qtfOKqw+11flRZfyN7Afn1uu/ +xZHbIuA/NN/h/n+GX/u12U2TnCNQ3K7lIYiWHAXppstSQsbsWV1GcO/zpnRgZcq EJt3NnI20vuR9jCT/bNfig3WAL5twtbkZIdDor1jz8lQfedNGDXBKzW8tY6qpeat P0UPafr8l52Svsxl/zPFCi41mFhOVVYNFXzgsWWxEsdRgwcDRn7mZU3egQlT/l+U FVmDx7qR1lMaECd1Oiy8CoY8IHFx0vq5rRcd7LVuHmkGq69Y/00oE/ktxAKbgBf/ j+uo9OrnAFK5mrL4XYNNA0yPlQjFltz67MJlWL5DiOc7ARnMPz4E+qcJKmOAkVw9 wj+gkSKFsnldlI4oNZMt+klNLQ5OJMG9ibALG9RYrZFSYIqg/FKrDxb7p1blE0cI 4iKY3k6Kh+C+1D8XTls3c8B5OjOt0Wtsix3/B7AE0DFHUTTulhN0DQX/RkT+dDfS x1eyo7Tap4tr2FLnvS4mmhWaC61z7Jyd0g5/MHPk8MgS5uU3SXPEXktwj880jOEe POXybGBdnOzHtptKSzVMS/B4ZqolJfpkIz7JNQ2FRGAdXl4XK4RcxBW3qGS8Jc0C MS1No/DA20tpJA8XTMn65wl70iRPzMLI8c971jdYDNYc06pGkeY= =L3hc -----END PGP SIGNATURE----- --rwEMma7ioTxnRzrJ-- From unknown Tue Jun 17 22:20:58 2025 X-Loop: help-debbugs@gnu.org Subject: bug#31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Mon, 18 Jun 2018 16:36:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 31831 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: 31831@debbugs.gnu.org Received: via spool by 31831-submit@debbugs.gnu.org id=B31831.15293397605705 (code B ref 31831); Mon, 18 Jun 2018 16:36:02 +0000 Received: (at 31831) by debbugs.gnu.org; 18 Jun 2018 16:36:00 +0000 Received: from localhost ([127.0.0.1]:55253 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fUx8K-0001Tx-AZ for submit@debbugs.gnu.org; Mon, 18 Jun 2018 12:36:00 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:59147) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fUx8I-0001Tp-MC for 31831@debbugs.gnu.org; Mon, 18 Jun 2018 12:35:58 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 8C7042122D; Mon, 18 Jun 2018 12:35:58 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute4.internal (MEProxy); Mon, 18 Jun 2018 12:35:58 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= mesmtp; bh=d3aSRpoc98RFrFDD25IGDSnB4yjsq6bQnNsDygnRkbk=; b=DaAkf QnMf4yCMvhJ7TOtaN4j5oM7+Pulfi8l+5wRFuTmrVf605vl76mP1U+6IUOzzUNFr dbbb4pl4ptpxM6/OSbOWLWxJGz8SOtWwTIpxrTbdfFlz3LTbYlhJHU8pBFSAi2Fo 4fyL1e5Vw3+MjrrkRfOtDJTt4i+KIXHhevo+DU= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=d3aSRpoc98RFrFDD25IGDSnB4yjsq 6bQnNsDygnRkbk=; b=IHARJ7JkDR/3kyOo/f5jXhfE1+zijbymYB8WuvtSfhgV0 GkKe49O8Tau0fYC7ZPA/8UM2Ye3Nq6ldVRfHAiYpd9IwB13iRfdY9D/mZZvreWva e921t5uDehTutMx8W+GR1e34hBnb4ouok+Cj0/Rot0bfT1hEWRzwRjrweRgdh3Ks uILKzSPLKiMVQcoDdDVMtbxCh0tpNY4nC/DICKbXrgzi30na9euqYtPS2EdSC0f8 7GQBdK2BHGf6YFj19D3u2fqmFkFVlVNe0DpT1CxDq4/gDs1UUJPzCA/x6FzPcJZ1 Byf/haOwiqCHs5PpBPr7gT7CLgbASXEEN93oU21wg== X-ME-Proxy: X-ME-Sender: Received: from localhost (unknown [172.58.225.64]) by mail.messagingengine.com (Postfix) with ESMTPA id D7F9BE4329 for <31831@debbugs.gnu.org>; Mon, 18 Jun 2018 12:35:57 -0400 (EDT) Date: Mon, 18 Jun 2018 12:35:56 -0400 From: Leo Famulari Message-ID: <20180618163556.GA10371@jasmine.lan> References: <20180614195049.GB4039@jasmine.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="T4sUOijqQbZv57TR" Content-Disposition: inline In-Reply-To: <20180614195049.GB4039@jasmine.lan> User-Agent: Mutt/1.10.0 (2018-05-17) X-Spam-Score: -0.7 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) --T4sUOijqQbZv57TR Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Thu, Jun 14, 2018 at 03:50:49PM -0400, Leo Famulari wrote: > I'll try OpenSSL next. Patched pushed for both OpenSSL branches, closing bugs 31833 and 31834. --T4sUOijqQbZv57TR Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlsn32wACgkQJkb6MLrK fwhcThAA2e5oy9Sy5FD+p/UFqXe09qD0q6El+lVN0ckWDF9dVwNsndTBIAAQJy4u /ezp98z85jTeQwsjnVT/9cNLpeLbjJr0hPMXtX9i9fwzW2X8sv8nNKCzfg9a96os rX72D6zpgtB4Gnr8htAmwuDAKyqlK34tBVbabw7A1gC1Bn3tu5xKP1o+VRwnCtDX MA/BvDFhqSFvyKxMMY0JkD0aRKRL0yoS+PR8wicMtpCvKxphUWzsGY2gFPI6Jzbl iWXSZyryQb9DwmLDi8HPYNRBB0x63gEVJVOhhNE2x5mWLKdDYN/V5Nui8abTtpTh 0s6bXkbGbXXNPNmCqjb4zpsx/voH4L4uz1Knl6p/AJ0QbiBUcrwMq9kVC4/Y35By 9RQd/yKSyDdzeAwxVsivYhF10eEUEF4UfpN7OZcUL61UVRcwyEAJwHbgsU1MWBow apsKzth6uVO0RHH90gAzfbkbch3xLYaYvzXl5e8XD2mqMIVP/JJoNXnaMHok+35N E2jAGxewz03ft4yj1ANKExJpfL2X/4XDhwiYTDfroeiN2NlUOVQlbJKYE1sjP8iW 6d4PBGL6JYdG3pNrWMk51VVUdB+NjlRqCIL7aI1H+Q9ILKuLZhwu5JHYBGiP23ai vlau2e3zhJ8pik/THq7JV0x9yNnB3yR0pjkwGdlOBqimawcFtTU= =00bL -----END PGP SIGNATURE----- --T4sUOijqQbZv57TR-- From debbugs-submit-bounces@debbugs.gnu.org Wed Jun 27 16:51:15 2018 Received: (at control) by debbugs.gnu.org; 27 Jun 2018 20:51:15 +0000 Received: from localhost ([127.0.0.1]:37920 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fYHPH-0000p7-5D for submit@debbugs.gnu.org; Wed, 27 Jun 2018 16:51:15 -0400 Received: from eggs.gnu.org ([208.118.235.92]:36072) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fYHPF-0000ou-K1 for control@debbugs.gnu.org; Wed, 27 Jun 2018 16:51:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fYHP9-0008QN-Rx for control@debbugs.gnu.org; Wed, 27 Jun 2018 16:51:08 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:55125) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fYHP9-0008QF-OO for control@debbugs.gnu.org; Wed, 27 Jun 2018 16:51:07 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=45504 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1fYHP9-0007eP-Ao for control@debbugs.gnu.org; Wed, 27 Jun 2018 16:51:07 -0400 Date: Wed, 27 Jun 2018 22:51:06 +0200 Message-Id: <87sh58vtqd.fsf@gnu.org> To: control@debbugs.gnu.org From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: control message for bug #31831 MIME-version: 1.0 Content-type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -6.0 (------) tags 31831 security From unknown Tue Jun 17 22:20:58 2025 X-Loop: help-debbugs@gnu.org Subject: bug#31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Mon, 16 Jul 2018 06:22:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 31831 X-GNU-PR-Package: guix X-GNU-PR-Keywords: security To: 31831@debbugs.gnu.org Received: via spool by 31831-submit@debbugs.gnu.org id=B31831.153172206830897 (code B ref 31831); Mon, 16 Jul 2018 06:22:02 +0000 Received: (at 31831) by debbugs.gnu.org; 16 Jul 2018 06:21:08 +0000 Received: from localhost ([127.0.0.1]:42224 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fewse-00082G-EP for submit@debbugs.gnu.org; Mon, 16 Jul 2018 02:21:08 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:34329) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fewsc-000828-Ec for 31831@debbugs.gnu.org; Mon, 16 Jul 2018 02:21:06 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 0BD3C21C5F; Mon, 16 Jul 2018 02:21:05 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Mon, 16 Jul 2018 02:21:06 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= mesmtp; bh=N2ijJ9493Zc1Tk9rHJ+CUj+RNzm7NNbXz5rR4nj7CYk=; b=mf28E Scm7+PEppbfSYeBHBPmqjNjLvneKqKkWKbM1NQ7m78jaajn9GuhLTu3UDuaZE5nE bFQosTjVNtcCYLT5Y1l+gN+jsL5pHi0PzprZGPC11B9BLdaCmt856qav4twjeHF2 88KOwGhacoT/tgax4L/wxNFVwTn3JEUnuI4ebM= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=N2ijJ9493Zc1Tk9rHJ+CUj+RNzm7N NbXz5rR4nj7CYk=; b=SblEoh412qNUTAkJRed5AUga0q5+WxkAbJAZnBPaNSjlm we7E7Nmf7qJVUUoq0D6XrdS1S2EeTtMOj7qJ5KoEUeK51oW9R3UTjRXVp6gk8Iim paspYvoq8x4/NUp5TOn+itJ0qTM9VZ0rLj0U97pZSRIhrX919i20uKQ4gFYP7GQE /4DPDMn2GxdLGzcsgQjA3n6FKud1SBljahLTVRIxQ7vmmGTwDocc5BUmQXP1L3FS 7zT9wr4XIWedkOXTL5y/2Ok8upQ+G15Ish8O+RN7S3tAOMjoUV0Y3xP+1ojzgpiq ILWWRYgc+2bVOyIWQESqdcIL5J92s9qSQn4AQRw2A== X-ME-Proxy: X-ME-Sender: Received: from localhost (c-76-124-202-137.hsd1.pa.comcast.net [76.124.202.137]) by mail.messagingengine.com (Postfix) with ESMTPA id 85E2910255 for <31831@debbugs.gnu.org>; Mon, 16 Jul 2018 02:21:05 -0400 (EDT) Date: Mon, 16 Jul 2018 02:20:34 -0400 From: Leo Famulari Message-ID: <20180716062034.GA3973@jasmine.lan> References: <20180614195049.GB4039@jasmine.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="TB36FDmn/VVEgNH/" Content-Disposition: inline In-Reply-To: <20180614195049.GB4039@jasmine.lan> User-Agent: Mutt/1.10.0 (2018-05-17) X-Spam-Score: -0.7 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) --TB36FDmn/VVEgNH/ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Fixed in Botan in Guix commit cfe255684cc4deb164d0eaaa2e1ed9804b5ff651. --TB36FDmn/VVEgNH/ Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAltMOTIACgkQJkb6MLrK fwjKtw/+Mv5TVaji6udJMOl8OOiQwIKjZcrtnPYoauL8EIGCpJbcz0DcVNwehgbG wK8CrdvdgE3c2oVg+FiGJ8wZU5hXjpYyy6VgQzqD96S7VosHeSGuXIoV/87MHaB/ nHpJGTzDKALaARxRJbtRG/x4xxN2cvzPuXJKJegdQ+8LBuEPaagT48pNNwguGtGD 77SQBWJBAf9ZyEFv0MLavrsdrgRvuB8J3H8UVUJyuWyXd6Y2DVfBS8lBsezx9SL4 9DMRY+TDhQZZHfs1nOs0nNPIq9UXTbthGOSTqBmCVbHUKh+UD4FCnQI0O77MxiU1 /FzYxy70HJZyBWvJAe85GiN6ATsH4QaIp/qAO/Gd8JYzooKbYUukZtDHTlAxfGLn a/NoKp13na1NNZ7qX63edeSB3e9gRaZkMCH/RVZN67EsdPqt4vlcOdGBmzO+Bpp3 slPnmpgjA+xxHtJ259wcfZkmMSRZUvX+ouK82QTTqfmpMWgjHvV2ITJXbbTOG0q+ 9GZSOlo+L8dpwwpqHBnTkxMt3SAcCHvwVnoC2d8TIu+az16Q02H9rphAszX9j5dW kHzUwMKK655Ugc3pYdFvSqvZmav1bsxsRhY94JNvlHq29MI3z7TD0xBM/n+28sWL AjFAcj2HTdt+/fbeHXCuG2Z4JMUpzQpqYq7AE4N/44Mu1CW751g= =AhNX -----END PGP SIGNATURE----- --TB36FDmn/VVEgNH/-- From unknown Tue Jun 17 22:20:58 2025 X-Loop: help-debbugs@gnu.org Subject: bug#31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries Resent-From: =?UTF-8?Q?G=C3=A1bor?= Boskovits Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Mon, 16 Jul 2018 06:55:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 31831 X-GNU-PR-Package: guix X-GNU-PR-Keywords: security To: Leo Famulari Cc: 31831@debbugs.gnu.org Received: via spool by 31831-submit@debbugs.gnu.org id=B31831.15317240581378 (code B ref 31831); Mon, 16 Jul 2018 06:55:01 +0000 Received: (at 31831) by debbugs.gnu.org; 16 Jul 2018 06:54:18 +0000 Received: from localhost ([127.0.0.1]:42236 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fexOj-0000MA-RP for submit@debbugs.gnu.org; Mon, 16 Jul 2018 02:54:18 -0400 Received: from mail-it0-f43.google.com ([209.85.214.43]:34886) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fexOg-0000Lv-2Y for 31831@debbugs.gnu.org; Mon, 16 Jul 2018 02:54:14 -0400 Received: by mail-it0-f43.google.com with SMTP id l16-v6so19672679ita.0 for <31831@debbugs.gnu.org>; Sun, 15 Jul 2018 23:54:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=b0Pir7EQpyOU1KcLxIUS45UceY1kcv4fCfggdbKrP4Y=; b=KOLLARTEn0tq6MJB6WMQU2hM4MjXWWU9szsF1q6jMRjdmx5/7eeykC9XUkJ6ucxPwy zOQfe8VZzKrcNsiUtWqymNl37sriEHm1afCLeLMl/+E75/A03W7mnBkUF+GYvPshM5J4 Wd3nzTNNeS/qo5dEROi72itjWysaJdw7gMABzQYpWhG/HIpjiHT7caAwNVvuakmhAEqD muJ9qFYZesfXRL7hPm8VR6P0abCCleOLI/aTa5f2tmZ5xcPnciUig5fIwA5RtGcwfei+ qOJ+lUlMATDtEuNhCAiodc0WkEH2Dy0/IGbvt8Uz77u7IYWiNicsJdzOh3sKS49Plw+0 zuCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=b0Pir7EQpyOU1KcLxIUS45UceY1kcv4fCfggdbKrP4Y=; b=R3KW8tQqLchfPkKQX5UTjS/eJYS6Og0CGtReRAXTpqMPDFCFe5quf/JYFgUInnzIEw j1zqmVi7QX1BcSoOuGo0PaGB39KpYOCozY0uU7PNjvvTJO220HDDsqZ0Yi0ZAx1DnB0n GsZ4k/SbhXZ2j+7jAZ2w2oUPxbFQDvvmhMobR6qEYXtuOQLZz9Bxrxu9xOQ8B5rFAMJQ Y6FLFOvn5wRY6rbibZssE7zOCcq815JcvlCYjDzVQfh1Q7idBwNqLAXIOEY19EmK6O3f ffnfrMEOQB3GDgwrcaLfG7A9MbozB/JO04zgQ+y68acBlcjdsw5rboV53vy1TsR0VONf ymfQ== X-Gm-Message-State: AOUpUlGI+N8QnjawKHnVhVxU9QiQvXbKfhUXep3ve1R6BfLCgnAKRh1Y IkiUvrRbXO/4R+vrAzPkiIYqFrDghBBMc86pMA== X-Google-Smtp-Source: AAOMgpcuqQMYbN/LHl2oz5RcoxW7zH4+qrrjwOTux0psFIqJpWQHS2SheB7IV0oRCMRc0OW9RVCBE/GzMBJ4+Cv1SYY= X-Received: by 2002:a02:7e45:: with SMTP id h66-v6mr13284990jac.97.1531724048386; Sun, 15 Jul 2018 23:54:08 -0700 (PDT) MIME-Version: 1.0 References: <20180614195049.GB4039@jasmine.lan> <20180716062034.GA3973@jasmine.lan> In-Reply-To: <20180716062034.GA3973@jasmine.lan> From: =?UTF-8?Q?G=C3=A1bor?= Boskovits Date: Mon, 16 Jul 2018 08:53:56 +0200 Message-ID: Content-Type: multipart/alternative; boundary="000000000000cc4d950571184bb6" X-Spam-Score: -0.0 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --000000000000cc4d950571184bb6 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Leo Famulari ezt =C3=ADrta (id=C5=91pont: 2018. j=C3=BA= l. 16., H 8:22): > Fixed in Botan in Guix commit cfe255684cc4deb164d0eaaa2e1ed9804b5ff651. > Are there any more packages needing attention? --000000000000cc4d950571184bb6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


= Leo Famulari <leo@famulari.name> ezt =C3=ADrta (id=C5=91pont: 2018= . j=C3=BAl. 16., H 8:22):
Fixed in= Botan in Guix commit cfe255684cc4deb164d0eaaa2e1ed9804b5ff651.
Are there any more packages needing atte= ntion?



--000000000000cc4d950571184bb6-- From unknown Tue Jun 17 22:20:58 2025 X-Loop: help-debbugs@gnu.org Subject: bug#31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Mon, 16 Jul 2018 17:15:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 31831 X-GNU-PR-Package: guix X-GNU-PR-Keywords: security To: =?UTF-8?Q?G=C3=A1bor?= Boskovits Cc: 31831@debbugs.gnu.org Received: via spool by 31831-submit@debbugs.gnu.org id=B31831.153176127711977 (code B ref 31831); Mon, 16 Jul 2018 17:15:01 +0000 Received: (at 31831) by debbugs.gnu.org; 16 Jul 2018 17:14:37 +0000 Received: from localhost ([127.0.0.1]:43977 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ff753-000377-2Q for submit@debbugs.gnu.org; Mon, 16 Jul 2018 13:14:37 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:41925) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ff74z-00036y-QV for 31831@debbugs.gnu.org; Mon, 16 Jul 2018 13:14:34 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 6BE0722076; Mon, 16 Jul 2018 13:14:33 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Mon, 16 Jul 2018 13:14:33 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=cc:content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= mesmtp; bh=JMDbR1e0JQy5LkfV0f+pAAuzyOIRXsY+xIfnQaPG008=; b=jf1eF QBzssQuDeBXeVGacjSujm3Qmpx8lQusWsbUf2ZcODmcsF1etx1gadmQF1uCGLKy9 CkSBQwNS4hdy/rWESK1oxfcl66Fx0Ds/sVTyJrutJYmmVBXZuFmFVr68zY8su6cr 7YYpEwUEPA1TT2XdXaibtvJpTWu0nwJgdNwZPc= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=JMDbR1e0JQy5LkfV0f+pAAuzyOIRX sY+xIfnQaPG008=; b=KGFL3jf8NfGp9ZJeGkhyWFdsvc+WU8tSV9wUPxmfZHvnO A4TFUJcgwTRT6pZn2JmO+vcJu3B1Eeg7Pe8zyvLYrEm2mUKFMlGLI32Mxs/vqUOC zlu73Ju3e441j7FAK3vvmJftAsoZe9NLBRuqcygiTKtLCHP0LeXJoI13TiXgiNV5 JMoiwXsPsycPe98bx6ocllKtZzkmN2In9j48Kt++uhHPJxSdnwPiw8fHLubG8t1t ekbdccNf1i7BsiF1fBi3qZgvG5h5rSawdDQ7SsP9xNgljLLh63G28Z6cRvWo9wJe kBowBWv0tiYd2eN90+KmqpBt+1930bzxjVjSZQsiw== X-ME-Proxy: X-ME-Sender: Received: from localhost (c-76-124-202-137.hsd1.pa.comcast.net [76.124.202.137]) by mail.messagingengine.com (Postfix) with ESMTPA id A00121025D; Mon, 16 Jul 2018 13:14:32 -0400 (EDT) Date: Mon, 16 Jul 2018 13:14:30 -0400 From: Leo Famulari Message-ID: <20180716171430.GA20978@jasmine.lan> References: <20180614195049.GB4039@jasmine.lan> <20180716062034.GA3973@jasmine.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="oyUTqETQ0mS9luUI" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.0 (2018-05-17) X-Spam-Score: -0.7 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) --oyUTqETQ0mS9luUI Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Jul 16, 2018 at 08:53:56AM +0200, G=E1bor Boskovits wrote: > Are there any more packages needing attention? libtomcrypt version 1.18.2 includes a fix; we would need to adapt this to the bundled copy in Dropbear. I can take a look at this today. NSS was fixed in Guix commit 7c3bea7e6299e1026c7964c83986a6b6c220879a by Marius. Thanks, Marius! The advisory mentions similar but not indentical issues in these packages: There is a new release of Crypto++ available. I'm not sure if this addresses whatever issue was mentioned in the original advisory. mbedTLS's changelog doesn't mention anything related to key extraction side channels. I don't see any related commits in Go's crypto/tls Git repo. --oyUTqETQ0mS9luUI Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAltM0nYACgkQJkb6MLrK fwhrbxAAnzWh9B+8lsvB/qL+N76f2srQRVKAf/XaddC/GG9pFM+6HhmdxZKsxOZ1 u/RqAsUbWRkCracIuujNJnjaYfR7CogDLhq87DJwAa5DkWTOe8xughPhU1Gk84rM UmgKIsq260p1Guk209tiQO9RadVz89h7SoB0aycUO1JphQWkHW8QuXd619aJ8QjM Psb4RFYB/wixV8pi7HMfI37/gVScy+gS5TvyClckQH/YIf5PrNp4yKE6sxhXQhTt ynA98n4P+tzVcEd2dpe2daztgFOPA4m1ZPolKda9gzwcr5rlRB9WTCgMWjkhXHg5 30/UihWWCdAgSm1Fx3TVxBOxCWy1doILBNfke+tDaZZH63B6aVpVrLX50D5GJQ91 5cvnQO+cQRvCEMMaGoH2Zsvsc6Bdb3wt6YwCuTZZAJOmk/xEpi/X0hVTQ4shu78m xN4KZW4KN4ZCpZcCvyqOUM3Kdk+fnGHdFaDNkR3yMPX0H3bPxI4j90+VziYI/Dal NCgYfHAKZcplsnPw2WYLhPBa5qj+jhG0rvoWmtk224dbcTg8rKpGrxlUMAbO5FZq KVKypvGqnWai4+6HCkvM7b49Puk/+5kAkClFmXRklLq16/XFjxlOggg63qfoEYpt GLiHObiOAK+eGM/YCPHnj3kXZGVwl5pD48cNmZuxon/lp+ejsek= =nik0 -----END PGP SIGNATURE----- --oyUTqETQ0mS9luUI-- From unknown Tue Jun 17 22:20:58 2025 X-Loop: help-debbugs@gnu.org Subject: bug#31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Mon, 16 Jul 2018 17:40:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 31831 X-GNU-PR-Package: guix X-GNU-PR-Keywords: security To: =?UTF-8?Q?G=C3=A1bor?= Boskovits Cc: 31831@debbugs.gnu.org Received: via spool by 31831-submit@debbugs.gnu.org id=B31831.153176277514348 (code B ref 31831); Mon, 16 Jul 2018 17:40:02 +0000 Received: (at 31831) by debbugs.gnu.org; 16 Jul 2018 17:39:35 +0000 Received: from localhost ([127.0.0.1]:43994 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ff7TB-0003jL-QY for submit@debbugs.gnu.org; Mon, 16 Jul 2018 13:39:34 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:55341) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ff7T9-0003jD-Pi for 31831@debbugs.gnu.org; Mon, 16 Jul 2018 13:39:31 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 8E1C9221E0; Mon, 16 Jul 2018 13:39:31 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute4.internal (MEProxy); Mon, 16 Jul 2018 13:39:31 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=cc:content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= mesmtp; bh=/gSRB/owwllNlYizcS4WUZkCvAiPyA898G9tL8hEVQY=; b=joCUi pvnqTnYtqa7T6l/nq/REEyD6cMgy4FlWoAkdQQg0/uIJpYoQKuze8bHYqk+ZJnlB 6qIBu+zwwuOki9pGOpJRgQACbQKtoGtB+FNi5cogjU8lPMl2HQpL9EEpxB65G4im xnKCNTSWN+VGSZ0ZXChO4csy8OUSVqIN5hHtOc= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=/gSRB/owwllNlYizcS4WUZkCvAiPy A898G9tL8hEVQY=; b=cfsbtU6yZaf9M8jPrfDOE41lFuHH1kPi8WP/OWrFZMx3u 2qsv4+pblvXHbPF2EtSPvYM03BQJ0R95LqmAgLAqt+obFcDtrAjdJQYN91giVpXu iJZOyO108C7Jmd6SrO2IY17k6RaJd4EWHGXBvyfEYlcJv0eiJrvNva1DB8Gb3C+F zwuzGqAdyVZ0u9rIEt1Dw2dPnUigTSqIibpyPH9qKwllxZZnQXUsHK13wqUN6AqZ 4S25STGJAYfdfEpOJTpCgtKy6wR96SRJcNNiAjVI59jZo6TC5NVWrLhFxQQJ1S7H 3vZPHc406/njnEywvtAChqwJXw1RSct68hYh2E6Cg== X-ME-Proxy: X-ME-Sender: Received: from localhost (c-76-124-202-137.hsd1.pa.comcast.net [76.124.202.137]) by mail.messagingengine.com (Postfix) with ESMTPA id 26295E49F9; Mon, 16 Jul 2018 13:39:31 -0400 (EDT) Date: Mon, 16 Jul 2018 13:39:29 -0400 From: Leo Famulari Message-ID: <20180716173929.GA24955@jasmine.lan> References: <20180614195049.GB4039@jasmine.lan> <20180716062034.GA3973@jasmine.lan> <20180716171430.GA20978@jasmine.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="azLHFNyN32YCQGCU" Content-Disposition: inline In-Reply-To: <20180716171430.GA20978@jasmine.lan> User-Agent: Mutt/1.10.0 (2018-05-17) X-Spam-Score: -0.7 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) --azLHFNyN32YCQGCU Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Mon, Jul 16, 2018 at 01:14:30PM -0400, Leo Famulari wrote: > libtomcrypt version 1.18.2 includes a fix; we would need to adapt this > to the bundled copy in Dropbear. I can take a look at this today. Dropbear's bundled libtomcrypt includes a variety of whitespace and comment changes that make it non-trivial to compare the actual differences between the codebases. I'm not going to work on adapting the upstream patch for Dropbear, but of course others are welcome to do it :) Otherwise I assume the Dropbear team will include the fixes whenever they make a new release. --azLHFNyN32YCQGCU Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAltM2FEACgkQJkb6MLrK fwhGjQ/+NKYomgpvn8e7q1b3LzFIDP3FcBc9512hNfFwEkY+i40IAD3bvB+W5+MI kMTiFW2PX+7lILJnuPehwIrFTiy1FptAYNlhPbx/E/iEgrjOtj526L+acHYdNSoU SU+abzLbkcxhes8FM5rMCDmB6YKy/bCaomo3sWKuwGtpSPqFlpbSpRVjWOkwi1Nl bHMD/hOPsbmbILYbpfDVKzTuWS8jPeTb00QpJyWjnNZ2IkD+ORhiQ6KnntlzK8Gr LIHJflM7YPq1y4DFHPdjAHYorVlO7Zl1Z04q2/bRBvE4ASuGbiQuAyxf29IBnW+E HUuSauz/n5qs9C3+yIgBkvjphowoXeJ0zYouW6SxyzcyFBMpvoXO1Ehk8JjajCNx g1o8kR45QUjsbZ7sA7RwfsKeTrBzSgzhmQy3A0Fc9zG/jYySL9o6RMmv8U5Pqz5K a0bVqKIMBD99pEGO5bvKgLv1iFFGf6BQocF4rU2UXXTc0If3MLd3mRqPShjFGQju 3AvuapupFw8aLIfTzsmZcMdtT4PSK3lWybfISoE62E2pbyxYm5iyQwfeo68tM3lw oNPb+TmtuELjeolmZHjiO2nQQfHihCjCkvCMuYUnh7GZsxjh4aR6bpBud34j9Ya7 NEBKnR/MCvCEdJdgcuWxzBH+vAZiMMmrrmTRrGktOr9uyHr32gc= =ZdMv -----END PGP SIGNATURE----- --azLHFNyN32YCQGCU-- From unknown Tue Jun 17 22:20:58 2025 MIME-Version: 1.0 X-Mailer: MIME-tools 5.505 (Entity 5.505) X-Loop: help-debbugs@gnu.org From: help-debbugs@gnu.org (GNU bug Tracking System) To: Leo Famulari Subject: bug#31831: closed (Re: bug#31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries) Message-ID: References: <20190226020108.GA25161@jasmine.lan> <20180614192211.GA21522@jasmine.lan> X-Gnu-PR-Message: they-closed 31831 X-Gnu-PR-Package: guix X-Gnu-PR-Keywords: security Reply-To: 31831@debbugs.gnu.org Date: Tue, 26 Feb 2019 02:02:02 +0000 Content-Type: multipart/mixed; boundary="----------=_1551146522-4536-1" This is a multi-part message in MIME format... ------------=_1551146522-4536-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Your bug report #31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Librar= ies which was filed against the guix package, has been closed. The explanation is attached below, along with your original report. If you require more details, please reply to 31831@debbugs.gnu.org. --=20 31831: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D31831 GNU Bug Tracking System Contact help-debbugs@gnu.org with problems ------------=_1551146522-4536-1 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at 31831-done) by debbugs.gnu.org; 26 Feb 2019 02:01:17 +0000 Received: from localhost ([127.0.0.1]:52027 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gyS3Y-0001A7-Qr for submit@debbugs.gnu.org; Mon, 25 Feb 2019 21:01:17 -0500 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:38039) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gyS3X-00019v-Ne for 31831-done@debbugs.gnu.org; Mon, 25 Feb 2019 21:01:16 -0500 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 7E8FF22167; Mon, 25 Feb 2019 21:01:10 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Mon, 25 Feb 2019 21:01:10 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=date:from:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=mesmtp; bh=2oZr+RPGx0HainMEjU3ctZRA oIeVgjOGKfWTuAjvtXc=; b=bZpN0jN3fYAwOwRzzBt1psMKbcDft10WWQ5rRdY0 oQok5vAJVgdH5vQnrczT9vZSq3jVeJC4W6wNi7sLxbuyE5b1HEaVkTIOI/RdcvaW +AEsoksHvYTXM56qyRODRoo/GLhiqsLINNkeb0RYPE3oMmDvrLB/5IWBWO/kDXSl 6k8= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=2oZr+R PGx0HainMEjU3ctZRAoIeVgjOGKfWTuAjvtXc=; b=OdmSvqZJjW68HGJqmXBcsg 5Si+oxGW3XiXdt1U9108XEdNmTY1r6qs7qzO+wlijbA9yPlacshHibsN5083N2ek gzj+NY9CmVLOTTrYBIUF2WOoH8QK1HpREuu5MuBMHFJtUXXQW1KKCeDueqVdUtgn BCuHEzHXuDULdhdeCxN1k7jfcS9yNoLZlnJ5Y87ywHQxLFgizpK22+3ZK3rRbUkp DcXQBF4HTDbIotbGAusdiHZQfGVJtG1gyjbfmrlrwbJhI7ZlRyk2xJ+vJ1atNA3g UF7u7CxzvLdhpwX/wCo8R0etrqN5AgpgX22zp4RlttQ+TOZlQcMDc9neJjsUjBiw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrudekgdegudculddtuddrgedtledrtddtmd cutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfhuthen uceurghilhhouhhtmecufedttdenuchmihhsshhinhhgucfvqfcufhhivghlugculdeftd dmnecujfgurhepfffhuffkfhggtggujggfsehgtderredtredvnecuhfhrohhmpefnvgho ucfhrghmuhhlrghrihcuoehlvghosehfrghmuhhlrghrihdrnhgrmhgvqeenucffohhmrg hinhepghhithhhuhgsrdgtohhmpdgtrhihphhtohhpphdrtghomhenucfkphepjeeirddu vdegrddvtddvrddufeejnecurfgrrhgrmhepmhgrihhlfhhrohhmpehlvghosehfrghmuh hlrghrihdrnhgrmhgvnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: from localhost (c-76-124-202-137.hsd1.pa.comcast.net [76.124.202.137]) by mail.messagingengine.com (Postfix) with ESMTPA id CE46810338 for <31831-done@debbugs.gnu.org>; Mon, 25 Feb 2019 21:01:09 -0500 (EST) Date: Mon, 25 Feb 2019 21:01:08 -0500 From: Leo Famulari Subject: Re: bug#31831: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries Message-ID: <20190226020108.GA25161@jasmine.lan> References: <20180614195049.GB4039@jasmine.lan> <20180716062034.GA3973@jasmine.lan> <20180716171430.GA20978@jasmine.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="qDbXVdCdHGoSgWSk" Content-Disposition: inline In-Reply-To: <20180716171430.GA20978@jasmine.lan> User-Agent: Mutt/1.11.3 (2019-02-01) X-Spam-Score: 0.5 (/) X-Debbugs-Envelope-To: 31831-done Cc: 31831-done@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.5 (/) --qDbXVdCdHGoSgWSk Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Mon, Jul 16, 2018 at 01:14:30PM -0400, Leo Famulari wrote: > There is a new release of Crypto++ available. I'm not sure if this > addresses whatever issue was mentioned in the original advisory. Crypto++ was updated to 8.0.0 in January 2019. https://www.cryptopp.com/release800.html > mbedTLS's changelog doesn't mention anything related to key extraction > side channels. mbedTLS has been updated several times since this bug was opened, and is currently at 2.16.0. https://github.com/ARMmbed/mbedtls/blob/fb1972db23da39bd11d4f9c9ea6266eee665605b/ChangeLog Neither of those upstreams have mentioned CVE-2018-0495, as far as I can tell. The original advisory said they do not use the vulnerable pattern, but do use "non-constant math, but different pattern". Overall, I don't think there is anything left for us to do as a distro in response to CVE-2018-0495, so I am closing this bug. --qDbXVdCdHGoSgWSk Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlx0neQACgkQJkb6MLrK fwjbVRAAxPBNbVo2JbxhwnagmAqBJstto7u/BbEB2FU0LPetyP96P5CCqXnXofqT eK8xl9uzs+taIyt0p1C7g/mWw7bUEpUrug800EsHhEjLUOmFeSXiHPIvQWns5BvU xRLP1kaL+9InnGaHkzIUubYt7ewmGQosXLjVX7pdVO0NaZJqXV0XdtcEPN9/Hz6w KofSzM6P3VCjP7uXuiwv8VTLFCIhjgIYmmrFMJP9G3PLB3wTQlpmcYtHQy4Da42g /6OuYjjGzLuF5QRt+Jmz77SQabZWbvCOmZsqRIZsz7LfkhfoJQMPdA10oOkjRvhk e87Buz53Jknu5QPodoYpvCLn7HPVi30oa5T7QPyXHMqV7iNBPmyieoE6Agjz4RzE gXua3WKWdebLPMSxjIAcYoUTs5RyxlVVckevvR8CukfIIIx6sBRrfJOR6hZR0/tY n/r2oG//oVAbqkTgo7lER24VMTWqkBRs9zBHXZBTQ/1HOG8nf9sabFpVZj3niLTE x9EcAJfY5oKG3yPxsogEf+QAAktfgJFdDFcxUkpgSXNpE0K6svJTKFTU2WKfnF94 vEoc1AsuYx7kUBtRWx0AijoqYHWtc7yMb/ouzwyM0B8Vxmd8TzetDb0wUUQjrlIK /Z386DfT8X+fw/en9U8qbTxN/5hkl88w8vloB4cUyQLIndOT91U= =bAaH -----END PGP SIGNATURE----- --qDbXVdCdHGoSgWSk-- ------------=_1551146522-4536-1 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at submit) by debbugs.gnu.org; 14 Jun 2018 19:23:53 +0000 Received: from localhost ([127.0.0.1]:48445 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTXqb-0001Uv-3Y for submit@debbugs.gnu.org; Thu, 14 Jun 2018 15:23:53 -0400 Received: from eggs.gnu.org ([208.118.235.92]:39998) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fTXqZ-0001Ui-3y for submit@debbugs.gnu.org; Thu, 14 Jun 2018 15:23:51 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fTXqA-0007ia-Ou for submit@debbugs.gnu.org; Thu, 14 Jun 2018 15:23:45 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:46327) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fTXqA-0007iH-GB for submit@debbugs.gnu.org; Thu, 14 Jun 2018 15:23:26 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58221) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fTXpO-0007gE-OD for bug-guix@gnu.org; Thu, 14 Jun 2018 15:23:26 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fTXp0-0006kK-Hr for bug-guix@gnu.org; Thu, 14 Jun 2018 15:22:37 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:43731) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fTXp0-0006iT-1m for bug-guix@gnu.org; Thu, 14 Jun 2018 15:22:14 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 10C7221398; Thu, 14 Jun 2018 15:22:13 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Thu, 14 Jun 2018 15:22:13 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=content-type:date:from:message-id:mime-version:subject:to :x-me-sender:x-me-sender:x-sasl-enc; s=mesmtp; bh=k0f0koaGOP0rRa X6wbOb/86j9HRpAtLxJRaSQRI12sI=; b=IPrqwGgEqL13uxZHS5g5ADGqHoO+NF /iiIP3J/raeNAaDNBcsmNQcct5pBtlq3wFqEB180xjdulrAEgaLI6uV9kMbcAoDa bSR4fZs0uRLDQP3iyvl7VMCtN6LawE3qI3MEFdo6Y5KIbwgRoVExTK3dUWDtG4T4 ITktBtEJ34B0Q= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; bh=k0f0koaGOP0rRaX6wbOb/86j9HRpAtLxJRaSQRI12sI=; b=kNxYFj/S 6qpFqvveXKXkwyMVD6sxtzMXfA47rZH6uVjY0BfDz8DlrZ6Q+osem4KA5yQ8YmsT 40HXui0d4jKDAkgFw15zxNuu3aoeLYHETf/OWf1bMUnJ9qCsrhujeVcwtONEffLf YYfQ1QZryuVYfIj4yQkKZsD7EuoVZK73QxysDGx2LXFGa4nnYzN7YTxud2POKNjh ELqv+XDPocQ3eZaGdOrL9iX/m2JCCCeerEnJmNQqfvBahR576N0QAfIJjDyPuHjH 0hNrctCtClXFvI5p8IgPRv3RaxD2RfhGCgQCc2U2df1nOAkruxi53r5a0XsKm10W BMfr6e8nXzu+ZQ== X-ME-Proxy: X-ME-Sender: Received: from localhost (c-76-124-202-137.hsd1.pa.comcast.net [76.124.202.137]) by mail.messagingengine.com (Postfix) with ESMTPA id 9CA0E1025C for ; Thu, 14 Jun 2018 15:22:12 -0400 (EDT) Date: Thu, 14 Jun 2018 15:22:11 -0400 From: Leo Famulari To: bug-guix@gnu.org Subject: CVE-2018-0495 Key Extraction Side Channel in Multiple Crypto Libraries Message-ID: <20180614192211.GA21522@jasmine.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="gBBFr7Ir9EOA20Yy" Content-Disposition: inline User-Agent: Mutt/1.10.0 (2018-05-17) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.1 (----) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.1 (-----) --gBBFr7Ir9EOA20Yy Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Recently a new side-channel key extraction technique was published as CVE-2018-0495, and it affects a lot of the cryptographic libraries we package: https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/?style=Cyber+Security An excerpt from that advisory: ------ We analyzed the source code of several open source cryptographic libraries to see if they contain the vulnerable code pattern in the code for ECDSA, DSA, or both. This list is accurate to the best of our knowledge, but it is not exhaustive. Only the first group was affected by this finding; the other three groups are not thought to be vulnerable. Contains vulnerable pattern: CryptLib (Both), LibreSSL (Both), Mozilla NSS (Both), Botan (ECDSA), OpenSSL (ECDSA), WolfCrypt (ECDSA), Libgcrypt (ECDSA), LibTomCrypt (ECDSA), LibSunEC (ECDSA), MatrixSSL (ECDSA), BoringSSL (DSA) Non-constant math, but different pattern: BouncyCastle, Crypto++, Golang crypto/tls, C#/Mono, mbedTLS, Trezor Crypto, Nettle (DSA) Constant time-math: Nettle (ECDSA), BearSSL, Libsecp256k1 Does not implement either: NaCl ------ Note that libtomcrypt is bundled in the Dropbear SSH implementation. I'm going to test the libgcrypt update now. I'd like for other Guix hackers to "claim" an affected package in this thread, and then investigate and test the fixes. Please make new debbugs tickets on guix-patches for each bug-fix patch you propose, and send the links to those tickets here. --gBBFr7Ir9EOA20Yy Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlsiwGMACgkQJkb6MLrK fwgrLBAA5ip/y3YmzlBCH4+BBgI1k/vC62as7GvuB7mLKe58wSP0SAz+ueRz3DEC MrRWN64trNSv5Ei8mAvwFmyNHyEd0KF7vagwPFfZKu+iH2jmOObbJmgPNfO5KyuK rJux+vYBo1u9tcfrkEcyeWvKcwtaVrPNpsc9kD7w9tA8X4sPh0jYq+FJ+izT/poY Ed2I+TLbGH5LKz0OX/6evRzybgW0vhhhrxexP2nfSlmS9xG4UPlUbbZTtzP2N8AH XJI+syV7v3/WWBrseUH39I1kOw0+f6n4fhZHCUHYQ2JKj+QCpebQGuUAcPcnbEIc YkykTNr6Ne2mHjVJNJ4HYdZG3jO/73ltkCvThERsxnY38AaqHbAJ5QCQWNPyjkgS MAbDMauqY3veCprUMl6qJhIrHss2MBGHKTwzUJjcqDGlsY1+B+pcvSFOfSKwLTqs CpU498lJ/HxmTFTa+K1X/+yzK0B1PwSMk1fiYnfbQCdx9IlUr4n0yUa5FmW61E8O gc85KY14GFnq/NoRBJt7RIGm4g6KD1yAn3kqkAd2lEMAY3Vc9dtK78S5qfE4NacI nZ8wGEyF2MwdpbIxRqhXkOzHY7VfEk9ybUjceEw/217SQFamJpx1TpH0Sk49xcIG CG5K2sz1xSSQETPL4YIlmute8mqbLgl6HYCo3AQeCeLsDoeP2oc= =qwNO -----END PGP SIGNATURE----- --gBBFr7Ir9EOA20Yy-- ------------=_1551146522-4536-1--