Fedora: FEDORA-2018-98ab6b4e56 moderate: Botan2 Side Channel Hardening

Botan is a BSD-licensed crypto library written in C++. It provides a

wide variety of basic cryptographic algorithms, X.509 certificates and

CRLs, PKCS \#10 certificate requests, a filter/pipe message processing

system, and a wide variety of other features, all written in portable

C++. The API reference, tutorial, and examples may help impart the

flavor of the library. This is the current stable release branch 2.x

of Botan.

Update Botan2 to 2.7.0. Focus of this release is on performance and side

channel hardening. - Address side channels in RSA key generation and ECDSA

signing - Side channel hardening in many core algorithms (modular

exponentiation, ECC scalar multiply, Karatsuba multiplication, Barrett

reduction, etc) to reduce the risk of future exploitable side channels. - Many

optimizations for ECC operations, RSA (including key gen), DSA, DH, and XMSS.

Typical speedups vs 2.6.0 is 10 to 40% depending on operation and key size. -Add Scrypt password hashing. Also supported is using Scrypt to derive keys for

private key encryption (format compatible with upcoming OpenSSL 1.1.1) - Add

base32 encoding/decoding - Plus many bug fixes and smaller enhancements

documented in the [release

notes](https://botan.randombit.net/news.html#version-2-7-0-2018-07-02)

[ 1 ] Bug #1591831 - CVE-2018-12435 botan: memory-cache side-channel attack on ECDSA signatures

https://bugzilla.redhat.com/show_bug.cgi?id=1591831

[ 2 ] Bug #1591163 - CVE-2018-0495 openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries

https://bugzilla.redhat.com/show_bug.cgi?id=1591163

su -c 'dnf upgrade --advisory FEDORA-2018-98ab6b4e56' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFRHQ7MB53ZRVKO3BAF3WDWTS6A7CC7K/