3 ms·
This is the only place that I've been able to find a decent list of vendors potentially affected. This lists all vendors, so you will have to ctrl-f for BSAFE.
by lawnchair_larry 13y ago
This is the only place that I've been able to find a decent list of vendors potentially affected. This lists all vendors, so you will have to ctrl-f for BSAFE.
To be completely clear, most vendors on this list are not known to be affected, only those listed as using the library, or libraries derived from it (also listed).
All entries using Dual_EC_DRBG are potentially affected, but it is believed that most do not use that by default. If it's the only one listed, you can probably assume they use it by default. Especially things called "Datacryptor DUAL_EC_DRBG" by Thales e-Security.
- eli 13y agoThis seems dangerous. If you're going to name and shame people, I think you've really got to be extremely sure you're naming the right people.
- DerpDerpDerp 13y agoThis isn't an article naming-and-shaming; it's an information dump so people can sort through it and find the right people to actually name-and-shame.
- ballard 13y agoThis lists which companies have certified implementations, not which products relies on which CSPRNG/s by default. I think there are already internal code audits underway by some of the listed entities, if not, it would be wise to get started real quick before customer anger arrives. If this is not a clear impetus for open source, eg, publicly audit-able code >>> trade secrets, I think we should keep blindly accepting black box solutions, from chip to app. No funny business ever happens without transparency.
- lawnchair_larry 13y agoUnfortunately, the stupid moderator submission title editing policy has struck again, so anybody seeing this has no context now. Thanks for being unhelpful, moderators!