Re: Does Heartbleed count for the purposes of BR 4.9.11 point 11? ("proven or demonstrated method")

2019-05-27 Thread Ryan Sleevi via dev-security-policy
On Monday, May 27, 2019, Matt Palmer via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > On Mon, May 27, 2019 at 06:06:42AM +0300, Ryan Sleevi wrote: > > On Mon, May 27, 2019 at 4:34 AM Matt Palmer via dev-security-policy < > > dev-security-policy@lists.mozilla.org> wrote: >

Re: Does Heartbleed count for the purposes of BR 4.9.11 point 11? ("proven or demonstrated method")

2019-05-26 Thread Matt Palmer via dev-security-policy
On Mon, May 27, 2019 at 06:06:42AM +0300, Ryan Sleevi wrote: > On Mon, May 27, 2019 at 4:34 AM Matt Palmer via dev-security-policy < > dev-security-policy@lists.mozilla.org> wrote: > > That sounds an *awful* lot like Heartbleed: "a [...] proven method that > > exposes the Subscriber's Private Key

Re: Does Heartbleed count for the purposes of BR 4.9.11 point 11? ("proven or demonstrated method")

2019-05-26 Thread Ryan Sleevi via dev-security-policy
On Mon, May 27, 2019 at 4:34 AM Matt Palmer via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > Hi everyone, > > In pondering ways of getting yet more keys for pwnedkeys.com, my mind > turned > to everyone's favourite bug, Heartbleed. Whilst hitting all the vulnerable >

Re: Does Heartbleed count for the purposes of BR 4.9.11 point 11? ("proven or demonstrated method")

2019-05-26 Thread Han Yuwei via dev-security-policy
If malloc() is correctly implemented, private keys are secure from Heartbleed. So I think it doesn't meet the criteria. CAs can't revoke a certificate without noticing subscriber in advance. But if any bugs found in future which can retrieve private keys from TLS endpoints, you can just use