#47222 - Serious bug in Nettle's ecdsa_verify

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #27 received at 47222@debbugs.gnu.org (full text, mbox, reply):

Received: (at 47222) by debbugs.gnu.org; 16 Apr 2021 20:47:01 +0000
From debbugs-submit-bounces@debbugs.gnu.org Fri Apr 16 16:47:00 2021
Received: from localhost ([127.0.0.1]:41783 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1lXVMi-0004AE-Ln
	for submit@debbugs.gnu.org; Fri, 16 Apr 2021 16:47:00 -0400
Received: from eggs.gnu.org ([209.51.188.92]:55902)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ludo@gnu.org>) id 1lXVMg-00049y-Ve
 for 47222@debbugs.gnu.org; Fri, 16 Apr 2021 16:46:59 -0400
Received: from fencepost.gnu.org ([2001:470:142:3::e]:48104)
 by eggs.gnu.org with esmtp (Exim 4.90_1)
 (envelope-from <ludo@gnu.org>)
 id 1lXVMb-00086L-CE; Fri, 16 Apr 2021 16:46:53 -0400
Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=39792 helo=ribbon)
 by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256)
 (Exim 4.82) (envelope-from <ludo@gnu.org>)
 id 1lXVMa-0004Hz-TR; Fri, 16 Apr 2021 16:46:53 -0400
From: Ludovic Courtès <ludo@gnu.org>
To: 47222@debbugs.gnu.org
Subject: Re: bug#47222: Serious bug in Nettle's ecdsa_verify
References: <cpfmtuwlv0k.fsf@slartibartfast.lysator.liu.se>
 <875z1kl24h.fsf@netris.org> <87h7kzblxk.fsf_-_@gnu.org>
 <cpfh7kzjjaj.fsf@slartibartfast.lysator.liu.se>
Date: Fri, 16 Apr 2021 22:46:50 +0200
In-Reply-To: <cpfh7kzjjaj.fsf@slartibartfast.lysator.liu.se> ("Niels
 Möller"'s
 message of "Thu, 25 Mar 2021 17:21:40 +0100")
Message-ID: <87im4m2c05.fsf@gnu.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: 47222
Cc: Mark H Weaver <mhw@netris.org>, Leo Famulari <leo@famulari.name>
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.7 (-)

Hi!

(- Niels, - nettle-bugs)

nisse@lysator.liu.se (Niels Möller) skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Are there plans to make a new 3.5 release including these fixes?
>
> No, I don't plan any 3.5.x release.
>
>> Alternatively, could you provide guidance as to which commits should be
>> cherry-picked in 3.5 for downstream distros?
>
> Look at the branch release-3.7-fixes
> (https://git.lysator.liu.se/nettle/nettle/-/commits/release-3.7-fixes/).
> The commits since 3.7.1 are the ones you need.
>
> Changes to gostdsa and ed448 will not apply, since those curves didn't
> exist in nettle-3.5. Changes to ed25519 might not apply cleanly, due to
> refactoring when adding ed448.

I confirm these patches don’t apply, and I’m not comfortable fiddling
with that.

Leo and I checked and found that Debian doesn’t have 3.5.  Do other
distros have backports of these patches to 3.5?

If not, our options are:

  1. to invest in the backport ourselves, with good peer review, ideally
     getting it stamped by Niels & co;

  2. to wait until a full rebuild has come.

It’s not an ideal situation.  Thoughts?

Ludo’.

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 01:38:45 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#47222 Serious bug in Nettle's ecdsa_verify