On Fri, Aug 5, 2016 at 8:57 PM, Niels Möller <[email protected]> wrote:
>> That's correct, but I think that's the responsibility of the caller to >> supply the corresponding keys. > But I think we'de want to ensure that nettle doesn't crash; an > application should be able to read key files controlled by an attacker > and use them with nettle without crashing (bogus outputs are of course > expected). > And I feel a little uneasy about ensuring that nettle's rsa functions > work without crashing if the size field is too large or too small; that > violates assumptions I made when writing the code quite some time ago... > It might be not too difficult, but I'd feel better about having the > _prepare functions be responsible for setting the size correctly. I think that's fair. And providing an efficient variant would be an incentive for applications to use them much easier. Anyway I believe I can work-around that. regards, Nikos _______________________________________________ nettle-bugs mailing list [email protected] http://lists.lysator.liu.se/mailman/listinfo/nettle-bugs
