[TLS] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 20 26-07-08)

On Thu, Jul 09, 2026 at 12:13:06PM +0000, Peter Gutmann wrote:
> Orr Dunkelman <[email protected]> writes:
> 
> >"In my opinion the issue is not implementation errors, they can be avoided
> >with the right discipline"
> 
> Has there ever been a vulnerability with a crypto, ah, implementation that
> *wasn't* an implementation error?
> 
Maybe it just was a rethorical quations,  but here is a quick brain dump, sorry
if I missed anybody's favoite:

Broken deployed crypo: MD4, MD5, RC4, SHA1, TETRA, A5/1, A5/2, ... sadly, this goes on
Too small choice of parameters: RSA-512 and other export-grade crypto
Bad design ideas: RSA prime generation by Infinon (ROCA)
Proocol:  RSA PKCS 1.5 and other padding oracles

All of those are weak even with an implementation that's perfectly matching the
specs,

All the best
	Tanja

_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]