Re: GnuTLS | Behavioral PKCS#1 v1.5 decryption oracle (Ok/Err bit) (#1901)
Read-only notification of GnuTLS library development activities <[email protected]> Tue, 09 Jun 2026 10:01:18 +0000
| Newsgroups | gmane.comp.encryption.gpg.gnutls.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============8705171145240521284==
Content-Type: multipart/alternative;
boundary="--==_mimepart_6a27e46e49469_37123cafc457018";
charset=UTF-8
Content-Transfer-Encoding: 7bit
----==_mimepart_6a27e46e49469_37123cafc457018
Content-Type: text/plain;
charset=UTF-8
Content-Transfer-Encoding: 7bit
Alicja Kario (@mention me if you need reply) commented: https://gitlab.com/gnutls/gnutls/-/work_items/1901#note_3436648783
Sorry @eslerm, I remembered that we fixed it, I misremembered how we fixed it in GnuTLS.
Yes, the API in GnuTLS can be used securely, it's just hard to do. Implicit rejection would be nice for calling applications but given that RSA PKCS#1v1.5 encryption is on the way out, it may be better to remove it than to add implicit rejection.
So, I agree on triaging it as a enhancement.
--
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1901#note_3436648783
You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/5-4lvle22pkqwkvpabn8b44aydx-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help
----==_mimepart_6a27e46e49469_37123cafc457018
Content-Type: text/html;
charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www=
.w3.org/TR/REC-html40/loose.dtd">
<html lang=3D"en" style=3D'--code-editor-font: var(--default-mono-font, "=
GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, =
Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospac=
e;'>
<head>
<meta content=3D"text/html; charset=3Dutf-8" http-equiv=3D"Content-Type">=
<title>
GitLab
</title>
<style data-premailer=3D"ignore" type=3D"text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Ro=
boto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Colo=
r Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size=
: inherit;
}
</style>
</head>
<body style=3D'font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.0=
1) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"=
Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif=
,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji=
";'>
<div class=3D"content">
<p style=3D"color: #777777;">
<a href=3D"https://gitlab.com/tomato42">Alicja Kario (@mention me if you =
need reply)</a>
<a href=3D"https://gitlab.com/gnutls/gnutls/-/work_items/1901#note_343664=
8783">commented</a>:
</p>
<div class=3D"md" style=3D"position: relative; z-index: 1; color: #3a383f=
; word-wrap: break-word;">
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Sorry <a href=3D"https://gitlab.com/eslerm" title=3D"Mark Esler"=
class=3D"gfm gfm-project_member js-user-link" data-user=3D"11517414" dat=
a-original=3D"@eslerm" data-container=3D"body" data-placement=3D"top" dat=
a-reference-type=3D"user" style=3D"color: #284779; background-color: #cbe=
2f9; border-radius: .25rem; margin-top: 0px; padding: 0 2px;">@eslerm</a>=
, I remembered that we fixed it, I misremembered how we fixed it in GnuTL=
S.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Yes, the API in GnuTLS can be used securely, it's just hard to d=
o. Implicit rejection would be nice for calling applications but given th=
at RSA PKCS#1v1.5 encryption is on the way out, it may be better to remov=
e it than to add implicit rejection.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px;" align=3D"initial">=
So, I agree on triaging it as a enhancement.</p>
</div>
</div>
<div class=3D"footer" style=3D"margin-top: 10px;">
<p style=3D"font-size: small; color: #626168;">
=E2=80=94
<br>
Reply to this email directly or <a href=3D"https://gitlab.com/gnutls/gnut=
ls/-/work_items/1901#note_3436648783">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target=3D"_blan=
k" rel=3D"noopener noreferrer" href=3D"https://gitlab.com">gitlab.com</a>=
. <a href=3D"https://gitlab.com/-/sent_notifications/5-4lvle22pkqwkvpabn8=
b44aydx-a84t7/unsubscribe" target=3D"_blank" rel=3D"noopener noreferrer">=
Unsubscribe</a> from this thread =C2=B7 <a href=3D"https://gitlab.com/-/p=
rofile/notifications" target=3D"_blank" rel=3D"noopener noreferrer" class=
=3D"mng-notif-link">Manage all notifications</a> =C2=B7 <a href=3D"https:=
//gitlab.com/help" target=3D"_blank" rel=3D"noopener noreferrer" class=3D=
"help-link">Help</a>
<span style=3D"color: transparent; font-size: 0; display: none; overflow:=
hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/gnutls/gnutls/-/work_it=
ems/1901#note_3436648783 at 1780999278
</span>
<script type=3D"application/ld+json">{"@context":"http://schema.org","@ty=
pe":"EmailMessage","action":{"@type":"ViewAction","name":"View Work item"=
,"url":"https://gitlab.com/gnutls/gnutls/-/work_items/1901#note_343664878=
3"}}</script>
</p>
</div>
</body>
</html>
----==_mimepart_6a27e46e49469_37123cafc457018--
--===============8705171145240521284==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Gnutls-devel mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnutls-devel
--===============8705171145240521284==--