Comment by CiPHPerCoder | Hacker News Reader

Top New Best Ask Show Jobs

Comment by CiPHPerCoder | Hacker News Reader

> end-to-end encrypted

O RLY?

https://git.jami.net/savoirfairelinux/ring-client-android/is...

https://security.stackexchange.com/a/171461/43688

I looked through their code to see where data is being encrypted/decrypted, and was unable to locate it.

Since their issue indicated they use 4096-bit RSA, I really wanted to see if they were vulnerable to Bleichenbacher's 1998 padding oracle attack.

https://git.jami.net/savoirfairelinux/ring-project/wikis/tec...

> The SHA-1 fingerprint (160-bits) of this public certificate is the JamiId.

this-is-fine.mp4

The code you were looking for is in the OpenDHT project, which simply calls GnuTLS's gnutls_pubkey_encrypt_data(), which is PKCS1v15. OpenDHT doesn't do anything special with errors from decryption. You'd have to actually set up a test environment to say it was vulnerable with any confidence, though.

Thanks Thomas!

> > The SHA-1 fingerprint (160-bits) of this public certificate is the JamiId.

I do not see any issue with this.

Probably related to this https://shattered.io/

Reply on news.ycombinator.com