4 ms·
If I'm reading this correctly it's only an encoding problem (which seems better than generating weak keys, etc.)? What are the security implications?
by KenoFischer 12y ago
If I'm reading this correctly it's only an encoding problem (which seems better than generating weak keys, etc.)? What are the security implications?
- hannob 12y agoOther implementations that do strict checks of the spec could reject keys generated by openssl. This could lead to connection failures and in some cases a retry on a less secure (or insecure) channel. Given that EC deployment on TLS is rare anyway this will probably not happen very often.
- agl 12y agoThis reported issue is with private key serialisation, not with public keys. So any issues would be at server startup time, when loading keys, rather than with connecting clients.
- hannob 12y agoAh okay. Thanks for that correction, that makes any security implications beyond "something doesn't work/start at all" even more unlikely.