Subject: Re: draft-ietf-dnsext-dnssec-online-signing-00

From: Ben Laurie <[email-masked]>
Date: Tue, 29 Nov 2005 22:08:46 +0000

Douglas Otis wrote:
> In the Security Consideration section,
> 
> There was no advice given on avoiding a timing-attack.  Essentially, the
> time required to sign a reply should not provide clues related to the
> underlying private-key.

For non-crypto folk thinking "wtf?", here's a reference:
http://crypto.stanford.edu/~dabo/abstracts/ssl-timing.html.

OpenSSL defends against this by default, but I guess that's not
universally true.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/
**  ApacheCon - Dec 10-14th - San Diego - http://apachecon.com/ **
"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>