Allele Security Alert
ASA-2018-00042
Identifier(s)
ASA-2018-00042, CVE-2018-5407
Title
Microarchitecture timing vulnerability in ECC scalar multiplication
Vendor(s)
The OpenSSL Project
Product(s)
OpenSSL
Affected version(s)
OpenSSL 1.0.2
OpenSSL 1.1.0 up to 1.1.0i
Fixed version(s)
OpenSSL 1.1.0i
OpenSSL 1.0.2q
Proof of concept
Unknown
Description
OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been shown to be vulnerable to a microarchitecture timing side channel attack. An attacker with sufficient access to mount local timing attacks during ECDSA signature generation could recover the private key.
Technical details
Unknown
Credits
Alejandro Cabrera, Aldaya, Billy Brumley, Sohaib ul Hassan, Cesar Pereida Garcia and Nicola Tuveri
Reference(s)
Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)
https://mta.openssl.org/pipermail/openssl-announce/2018-November/000137.html
Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)
https://www.openssl.org/news/secadv/20181112.txt
Changes between 1.0.2p and 1.0.2q
https://www.openssl.org/news/cl102.txt
CVE-2018-5407
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5407
CVE-2018-5407
https://nvd.nist.gov/vuln/detail/CVE-2018-5407
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: February 28, 2019