OpenPKG CVS Repository
http://cvs.openpkg.org/
____________________________________________________________________________
Server: cvs.openpkg.org Name: Ralf S. Engelschall
Root: /e/openpkg/cvs Email: [EMAIL PROTECTED]
Module: openpkg-web Date: 19-Feb-2003 16:25:30
Branch: HEAD Handle: 2003021915253000
Modified files:
openpkg-web/security OpenPKG-SA-2003.013-openssl.txt
Log:
more details derived from Mark J. Cox
Summary:
Revision Changes Path
1.6 +9 -3 openpkg-web/security/OpenPKG-SA-2003.013-openssl.txt
____________________________________________________________________________
patch -p0 <<'@@ .'
Index: openpkg-web/security/OpenPKG-SA-2003.013-openssl.txt
============================================================================
$ cvs diff -u -r1.5 -r1.6 OpenPKG-SA-2003.013-openssl.txt
--- openpkg-web/security/OpenPKG-SA-2003.013-openssl.txt 19 Feb 2003 15:23:40
-0000 1.5
+++ openpkg-web/security/OpenPKG-SA-2003.013-openssl.txt 19 Feb 2003 15:25:30
-0000 1.6
@@ -37,9 +37,15 @@
modified ciphertext blocks will be rejected by the peer (and the
connection aborted), but the attacker may be able to use timing
observations to distinguish between two different error cases, namely
- block cipher padding errors and MAC verification errors. This is
- sufficient for an adaptive attack that finally can obtain the complete
- plaintext block.
+ block cipher padding errors and MAC verification errors.
+
+ This is sufficient for an adaptive attack that finally can obtain the
+ complete plaintext block. Although this cannot be easily exploited,
+ because the attack requires the ability to be a man-in-the-middle,
+ repeated communications that have a common plaintext block, decoding
+ failures not signalling problems on the client and server side, and
+ a network between the attacker and the server sufficient enough to
+ reasonably observe timing differences.
OpenSSL version since 0.9.6c supposedly treat block cipher padding
errors like MAC verification errors during record decryption [1], but
@@ .
______________________________________________________________________
The OpenPKG Project www.openpkg.org
CVS Repository Commit List [EMAIL PROTECTED]
