Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations

[Billy Brumley <bbrumley () gmail com>]

> > Are we sure that a "low" rating is justified?
> > DSA is basically dead, until the constant time switch is flicked. The
> > only countermeasure so far is turning it off.
>
> Maybe I should be a little more verbose on this:
> 1) attacker recovers the DSA host key.
> 2) attacker mitm-attacks client connections to the server and recovers the user's private key by exploiting the 
> vulnerable openssl on the client side
> 3) ...
>
> The same principles apply when the computational burden is reversed for client auth, aren't they?

Are you talking about the SSH target?

If so, the realistic scenario is a user with legitimate credentials
logging into a server to steal the DSA host key locally with cache
timings.

I don't think client-side enters into the equation for this vuln. You
need an active attacker initiating handshakes. That's my 2c -- we
didn't consider client-side victim much in this work.

If it's the TLS target, you need local access or manage to co-locate
in cloud scenarios. Not as realistic as the SSH case IMO.

BBB