Closed Bug 657858 Opened 14 years ago Closed 14 years ago

Review ECDSA code for timing attack vulnerabilities

Categories

(NSS :: Libraries, defect)

Product:
NSS
Component:
Libraries
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED DUPLICATE of bug 660394

People

(Reporter: briansmith, Unassigned)

References

Details

(Whiteboard: [sg:audit])

+++ This bug was initially created as a clone of Bug #648153 +++ "We use this vulnerability [in OpenSSL] to steal the private key of a TLS server where the server authenticates with ECDSA signatures. Using the timing of the exchanged messages, the messages themselves, and the signatures, we mount a lattice attack that recovers the private key." http://eprint.iacr.org/2011/232
Douglas Stebila has fixed this bug in bug 660394, so I marked this bug as a duplicate even though it was filed first.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
Target Milestone: --- → 3.13
Group: core-security
You need to log in before you can comment on or make changes to this bug.