|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
|
Cryptlib Information for VU#845620
| Date Notified: | 2006-09-06 |
| Date Updated: | |
| Statement Date: | |
| Status Summary: | Unknown |
Vendor StatementAlthough cryptlib shouldn't be vulnerable to the original Bleichenbacher attack, there is ongoing discussion about further attacks that affect any RSA keys with e=3. Because the security community currently doesn't know how serious the problem is, cryptlib users should disable the use of any RSA keys with e=3 by changing the check 'if( BN_get_word( e ) < 3 )' in initCheckRSAkey() in context/kg_rsa.c to 'if( BN_get_word( e ) < 17 )'. Note that this will disable the use of a small number of existing keys that use e=3 (although cryptlib itself will never generate or use private keys with this
value), but until the exact nature of the problem is fully understood this is the only safe fix.Vendor InformationThe vendor has not provided us with any further information regarding this vulnerability.
AddendumThere are no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
 |
