Passive SSH Key Compromise via Lattices [pdf]

Re:Passive SSH Key Compromise via Lattices [pdf] by tptacek on Monday November 06, 2023 @11:40AM (#38164863)

IIUC, the original 2001 countermeasure for this is embedded in the modexp routine, and both OpenSSL (in rsa_ossl.c) and LibreSSL libcrypto (in rsa_eay.c) have substantially the same logic.

Look for the comment:

    /*
     * 'I' and 'vrfy' aren't congruent mod n. Don't leak
     * miscalculated CRT output, just do a raw (slower)
     * mod_exp and return that instead.
     */

[ Parent | on HN ]

Re:Passive SSH Key Compromise via Lattices [pdf] by fweimer on Monday November 06, 2023 @02:35PM (#38167674)

Note that in the OpenSSL case at least, this check is in the default engine/plugin, not in generic code. If you load a different plugin, you only get protection if the engine/plugin implements a similar check internally.

(I expect that LibreSSL removed the plugin framework, but I haven't checked.)

[ Parent | on HN ]