[Full-Disclosure] Re: [ADVISORY] Timing Attack on OpenSSL

• Previous message: bugzillaat_private: "[Full-Disclosure] [RHSA-2003:098-00] Updated 2.4 kernel fixes vulnerability"
• In reply to: Christopher Fowler: "[Full-Disclosure] Re: [ADVISORY] Timing Attack on OpenSSL"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This is a different vulnerability.  The one you patched two weeks ago 
was caused by a failure to decrypt messages when the MAC comparison 
failed.  This vulnerability is a timing attack against the RSA algorithms.

The Slashdot discussion is here:

  http://slashdot.org/article.pl?sid=03/03/14/0012214&mode=thread&tid=172

The paper is here:

  http://crypto.stanford.edu/~dabo/abstracts/ssl-timing.html



Christopher Fowler wrote:

>Is this a new advisory.  I've patched for a previous timing attack 2
>weeks ago.
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

• Next message: Caleb Sima: "SPI ADVISORY: Remote Administration of BEA WebLogic Server and Express"
• Previous message: bugzillaat_private: "[Full-Disclosure] [RHSA-2003:098-00] Updated 2.4 kernel fixes vulnerability"
• In reply to: Christopher Fowler: "[Full-Disclosure] Re: [ADVISORY] Timing Attack on OpenSSL"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Mar 17 2003 - 09:14:58 PST