Hacker News Reader

Parent Full thread

tptacek

Oh, you mean like potential remote code execution in AES?

View on HN

For reference, it looks like he's referring to this:

http://freecode.com/articles/suse-new-krb5-packages-fix-remo...

If I wanted to play dirty, I'd have mentioned ASN.1. :)

Or allowing \0 in X.509 fields.

I agree, ASN.1 sucks in terms of implementation in security-critical contexts.

But it's not a NIST or IETF standard, so it doesn't count. It's from ISO/IEC/ITU.

Do you have a link to the code with the bug?

I'll bet that "Specially crafted AES and RC4 packets" does not actually refer to the implementation of a NIST standard algorithm, just its usage in a context outside of such a standard.

Reply on news.ycombinator.com