3 ms·
On a scale of 1-10, it was about a 15 on the broken scale. As explained in the comments on the patch, a public exponent of 1 means a private exponent of 1 (it'
by daeken 13y ago
On a scale of 1-10, it was about a 15 on the broken scale. As explained in the comments on the patch, a public exponent of 1 means a private exponent of 1 (it's the inverse). This makes it completely, trivially broken.
- ams6110 13y agoSo why don't the crypto libs at least throw a warning that "what you're doing is nonsensical" if not just reject an exponent of 1 outright? We hammer on people not to invent their own crypto, yet here someone is, using the RSA lib, and still doing it wrong.
- MichaelSalib 13y agoThey're not using a crypto library, they implemented RSA from scratch.
- paulgb 13y agoThey're using a library (M2Crypto) to generate the an RSA key at least, so ams6110's point stands.
- MichaelSalib 13y agoOh. Sorry about that. I should have looked at the diff more carefully.
- dekz 13y agoBecause crypto libs can't see the future. I'm struggling to think of a case where using cryptographic primitives should be bubblewrapped. Don't use the primitives if you don't know what you're doing.