A security research group's blog on cryptographic attacks and flaws in TLS, PDF encryption and signatures, messaging apps, and printers.
HN commenters cite it as a helpful explanation of invalid curve attacks, which leak secret keys when implementations lack proper checks.
Yeah, no. That might take several days. Check out some of the names mentioned in the textfile, such as the Heartbleed Bug and then some of the links, such as 'Damage control'.
Besically, a patch to SSL authentication lead to moar craziness and somehow there's a debate whether the protocol is broken in itself. Well, not broken, but if like everything needs to be rewritten kinda. :)
^^ Referring to depreciating the way the auth chains are stacked... Ugh, "MAC-then-Encrypt" @http://web-in-security.blogspot.rs/2016/05/curious-padding-oracle-in-openssl-cve.html
Edit (looks like I can edit): Sorry, can't edit and it's 4AM losing my mind. There are things that have been exploited 3 years ago and then 1 year ago which are still very much implemented. I think that is the problem.
> How bad is it really?
Really bad.
Invalid curve attacks will leak your secret key, which most old implementations (i.e. the ones likely to end up in your hardware) don't protect against.
If you reuse an ECDSA nonce, you will leak your secret key.
If you have even the smallest timing leak, guess what.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7056
https://web-in-security.blogspot.com/2015/09/practical-invalid-curve-attacks.html
I found this article helpful: https://web-in-security.blogspot.com/2015/09/practical-invalid-curve-attacks.html
Essentially, a bunch of ECC implementations didn't do proper bounds checking and leaked data. ECC still offers a lot of benefits in terms of key size, performance, and security, however, so do your research carefully.
I'm with you on this one. This 'RSA is evil' conclusion is like taking a look at [1]---or the gazillion Schnorr-style signature scheme nonce leaks published over the years---and concluding that elliptic curves are evil.
[1] http://web-in-security.blogspot.com/2015/09/practical-invalid-curve-attacks.html