| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <gemini.kkcp9k09cyp8w031t.taviso@sdf.lonestar.org> Date: Thu, 28 May 2009 13:01:07 +0200 From: Tavis Ormandy <taviso@....lonestar.org> To: full-disclosure@...ts.grok.org.uk Cc: bugtraq@...urityfocus.com Subject: Re: [TZO-27-2009] Firefox Denial of Service (Keygen) Thierry Zoller <Thierry@...ler.lu> wrote: > According to a Bugzilla entry memory is also leaked during the process. > > So let's recap, we have a function that generates key material and looping > causes memory to leak. One might think this should be important enough to > investigate, especially if you know that for DSA for instance, only a few > bits of k can reveal an entire private key. [3] > > Note: I am not saying the memory leaks include key material, seeing the > lack of interest this bugzilla ticket triggered, I have not considered > investigating further. What I am saying is that if security is taken > seriously memory leaks that directly or indirectly happen during key > generation need to be investigated thoroughly. > I suspect there may be a language issue here, you seem to be confusing the terms "information leak" and "memory leak", they're entirely unrelated concepts despite the similar name. Thanks, Tavis. -- ------------------------------------- taviso@....lonestar.org | finger me for my pgp key. ------------------------------------------------------- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists