[cabfpub] Blog post on Infineon key generation issue

[Geoff Keating]

https://crocs.fi.muni.cz/public/papers/rsa_ccs17

“A newly discovered vulnerability in generation of RSA keys used by a software library adopted in cryptographic smartcards, security tokens and other secure hardware chips manufactured by Infineon Technologies AG ... Assess your keys now with the provided offline and online detection tools and contact your vendor if you are affected.”

It sounds like for CAs, the remediation is to implement the detection tool as a pre-check before issuing a certificate, and then start on the process of checking existing certificates for the flaw.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20171016/bb82d680/attachment-0002.html>