<div style="font-family: 'Calibri', 'sans-serif';"><div dir="ltr">
<div dir="ltr">Seems to me the fault is entirely Intel's. No programmer can be expected to make unsafe hardware safe.</div><div dir="ltr"><br></div><div dir="ltr"><div dir="ltr">Daryl</div></div>
</div><br><div id="htc_header">----- Reply message -----<br>From: "Trevor Cordes" <trevor@tecnopolis.ca><br>To: "MUUG RndTbl" <roundtable@muug.mb.ca><br>Subject: [RndTbl] openssl bug<br>Date: Mon, Mar 14, 2016 00:31</div></div><br><div dir="ltr"><pre style="word-wrap: break-word; white-space: pre-wrap;">A side-channel attack was found which makes use of cache-bank conflicts on
the Intel Sandy-Bridge microarchitecture which could lead to the recovery
of RSA keys. The ability to exploit this issue is limited as it relies on
an attacker who has control of code in a thread running on the same
hyper-threaded core as the victim thread which is performing decryptions.
This issue affects OpenSSL versions 1.0.2 and 1.0.1.
========
Uhh... Umm... OK. How does one decide to start looking at hardware
cache-bank conflicts to hack RSA keys?
Worse yet, how is a programmer supposed to think of this stuff in his
"brainstorm what can go wrong" phase of programming? "Oh, I need to alter
my code to ensure it uses different cache banks on Sandy-Bridge." This is
insane.
_______________________________________________
Roundtable mailing list
Roundtable@muug.mb.ca
<a href="http://www.muug.mb.ca/mailman/listinfo/roundtable">http://www.muug.mb.ca/mailman/listinfo/roundtable</a>
</pre></div>