| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
| |
Using the Montgomery ladder for operator* was introduced in ca155a7e54, previous
versions did something different, which was itself vulnerable to side channels,
but not with the same issue as CVE-2018-20187.
|
| |
|
|
|
|
|
|
|
|
|
| |
As doing so means that information about the high bits of the scalar can leak
via timing since the loop bound depends on the length of the scalar. An attacker
who has such information can perform a more efficient brute force attack (using
Pollard's rho) than would be possible otherwise.
Found by Ján Jančár (@J08nY) using ECTester (https://github.com/crocs-muni/ECTester)
CVE-2018-20187
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
We would incorrectly accept invalid matches for example b*.example.net
could match foobar.example.net
Introduced in 289cc25709b08
|
| | |
|
| |
|
|
|
|
| |
Introduced in 455bd2557cbb1343e59eefd97cb449f06a702c28
Found and reported by Roman Pozlevich
|
| |
|
|
| |
CVE-2017-2801
|
| |
|
|
|
|
|
|
|
| |
Specifically 9644a3ecebb15. So 1.10 was not affected, as it instead
throws an exception for passwords longer than 56 chars, which is
incompatible with other bcrypt APIs but does not introduce any security
problems.
[ci skip]
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
The 56 char bound is bogus; Blowfish itself allows at most 448 bits
in the key schedule, but Bcrypt's modification allows up to 72 chars
for the password. Bug pointed out by Solar Designer.
Also reject work factors 0...3 since all other extant bcrypt
implementations require at least work factor 4.
Adds more bcrypt tests generated by crypt_bcrypt and OpenBSD's version.
|
| |
|
|
|
|
|
| |
Move some text and change some headers to look better with how rtd
theme formats the table of contents.
GH #822
|
| |
|
|
| |
[ci skip]
|
| | |
|
| | |
|
| |
|
|
| |
[ci skip]
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
[email protected] is still a valid email address for me but I am
using [email protected] going forward.
[ci skip]
|
| | |
|
| |
|
|
| |
[ci skip]
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
If affine coordinates larger than the prime modulus were given,
a later multiplication could overflow the size of an allocated
output buffer, which was sized based on the size of the prime.
This will cause an overflow into either the system heap or if the
mlock/mmap pool allocator is in use, then into the adjacent key
material stored in the pool.
Reported by Alex Gaynor who found it with AFL
Also fix a one word overwrite in P-521 reduction. Found with AFL
|
| |
|
|
|
|
|
| |
It first computed the first i for q**(2**i) == 1, then checked that i
was smaller than s. Given a composite modulus (for which the algorithm
does not work), the loop might do a very large amount of work before
returning the failure.
|
| | |
|
| | |
|
|
|
Based on GH #272
|
