3
$\begingroup$

Are there any well-known crypto APIs or libraries that leak or used to leak information (it can be the key or anything else)?

$\endgroup$
  • $\begingroup$ Most crypto libraries had their fair share of security vulnerabilities, most being side-channel attacks or fault-based attacks or errors in advanced implementation features (f.ex. in side-channel protection). Can you please be more concrete with your question then? $\endgroup$ – SEJPM Jun 29 '16 at 21:42
2
$\begingroup$

Here's a classic timing attack against SSH:

http://people.eecs.berkeley.edu/~daw/papers/ssh-use01.pdf

As SSH is an encrypted terminal, it would send a packet each time you press a key. As you type your password, for example, you leaked the length of your password and also the timing. This could be used to reconstruct your likely password and make it feasible to iterate over the probable alternatives.

Attacks in a similiar vein have afflicted other protocols such as TLS https://www.schneier.com/blog/archives/2010/03/side-channel_at.html

(Just today EBay was criticized for sending every keypress of new passwords to their servers (over TLS) as you type them; their password strengthometer is server-side. Many people maintain this is not a real problem.)

$\endgroup$
4
$\begingroup$

The classic one that I can think of off the top of my head, that also happened relatively recently and posed a pretty widespread threat, was the Heartbleed bug. It was a big security vulnerability that would reveal authentication info in one of the most common ways communication gets encrypted over the internet, SSL/TLS. Most computers were affected, if I recall correctly, except coincidentally Macs, because they happened to use a different library to handle SSL/TLS.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.