lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 22 May 2020 15:22:38 +0200
From: Giuseppe Cocomazzi <>
Subject: [FD] [IAIK JCE] Timing Attack Side Channel in DSA Implementation

IAIK JCE is a provider for the Java Cryptography Extension that,
according to the vendor, "supplements the security functionality of
the default JDK". It is a commercial product developed by Stiftung
Secure Information and Communication Technologies:

The way that some of the computations involved in the signature
generation are carried out introduces a side channel that leaks timing
information about the ephemeral number k.

Full details about the vulnerability are available here:

Giuseppe Cocomazzi

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists