News for hackers. Stuff that matters.

A comment on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.". Parent comment

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by forty on Sunday March 31, 2024 @02:56AM (#39882032)
I have often seen the secret component of an asymmetric key pair referred as secret key as well. See libsodium for example. Maybe it's because curve/ed 25519 secrets are 32 random bytes unlike RSA keys which have specific structure which makes them distinct from generic secrets.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by tux3 on Sunday March 31, 2024 @04:46AM (#39882556)
It also allows "pk" and "sk" as overly short variable names, an argument developpers are sometimes tempted by!
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by forty on Sunday March 31, 2024 @11:17AM (#39885030)
Absolutely, it's very convenient when working on a whiteboard :)
[ Parent | on HN ]