Constant-time comparison is not always implemented; critical areas are vulnerable to key-timing attacks

密码学缺陷 / Missing Required Cryptographic Step / #363680

厂商

Monero

严重程度

高危

赏金

—

弱点

Missing Required Cryptographic Step

研究员

@anonimal

披露日期

2018-08-06

资产

—

CVE

—

该报告还没有中文解读。

In my most superficial of reviews, constant-time comparison appears to not be globally implemented (at a glance, only implemented within the ref10 implementation).