Bug 822009 (CVE-2021-43398)

Summary:	dev-libs/crypto++: correlation between execution time and privkey length
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED INVALID
Severity:	minor	CC:	sam
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/weidai11/cryptopp/issues/1080
Whiteboard:	B4 [upstream]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2021-11-05 20:40:28 UTC

CVE-2021-43398:

Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks.

Comment 1 John Helmert III archtester

2022-10-03 01:48:25 UTC

"Hi Everyone,

We are going to close this a "not a bug". We believe it is expected behavior. We don't believe the CVE is valid.

@CindyZhouYH, if you can provide a test program and test data we would be happy to revisit it."

*shrug*