<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi Guido,</p>
<p>is it possible to provide references to publications for the
problem that you aim to solve? <br>
</p>
<p>Best regards,<br>
Falko<br>
</p>
<div class="moz-cite-prefix">Am 26.05.25 um 19:11 schrieb Guido
Trentalancia via Gcrypt-devel:<br>
</div>
<blockquote type="cite"
cite="mid:1748279481.6610.21.camel@trentalancia.com">
<pre wrap="" class="moz-quote-pre">The vulnerabilities being tackled by the patch proposed here are
hardware vulnerabilities that exist in the CPU.
They were introduced with branch-prediction and other speculative-
execution CPU optimizations.
Because, once exploited, they materialize in Information Disclosure
(data leaks), cryptographic software is the most affected class of
software, because cryptographic keys or encrypted data can be leaked.
Unfortunately not all of such hardware vulnerabilities can be tackled
by a CPU microcode update, some of them need to be tackled in software:
this is what this patch aims to do (software-based mitigation of
hardware vulnerabilities).
An equivalent patch has been already proposed for the gnupg application
and another one might be proposed for the gnutls library.
In fact, only tackling libgcrypt is not enough, because cryptographic
applications such as gnupg also handle the cryptographic keys (e.g.
passphrases) and the sensitive data to be encrypted: these are then
passed to the libgcrypt cryptographic functions for actual encryption
and decryption.
The "pros" of this patch are that it avoids the risk of leaking
cryptographic keys or decrypted data on CPUs that are affected by those
vulnerabilities.
The "cons" of this patch are decreased execution speed: this is not
normally noticeable to the user.
I hope this helps.
On Mon, 26/05/2025 at 16.53 +0200, Werner Koch wrote:
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">On Sun, 25 May 2025 17:25, Guido Trentalancia said:
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">Disable CPU speculation-related misfeatures which are in
fact vulnerabilities causing data leaks:
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
Please see my comments on gnupg-devel.
Shalom-Salam,
Werner
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
_______________________________________________
Gcrypt-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Gcrypt-devel@gnupg.org">Gcrypt-devel@gnupg.org</a>
<a class="moz-txt-link-freetext" href="https://lists.gnupg.org/mailman/listinfo/gcrypt-devel">https://lists.gnupg.org/mailman/listinfo/gcrypt-devel</a>
</pre>
</blockquote>
<div class="moz-signature">-- <br>
<!-- MTG AG HTML signature v.1.0, 2021-02-12 - Author: Andreas Cholet -->
<div style="font-family: Arial,serif">
<p
style="line-height: 1.5; font-size: small; color: rgb(93, 93, 95);"> <strong>MTG
AG</strong><br>
Dr. Falko Strenzke <br>
</p>
<p style="font-size: small; color: rgb(93, 93, 95);"> <span
style="display:inline-block;width:4em">Phone: </span>+49
6151 8000 24<br>
<span style="display:inline-block;width:4em">E-Mail: </span><a class="moz-txt-link-abbreviated" href="mailto:falko.strenzke@mtg.de">falko.strenzke@mtg.de</a><br>
<span style="display:inline-block;width:4em">Web: </span><a
href="https://www.mtg.de" title="MTG AG Internet"
target="_blank">mtg.de</a>
</p>
<hr
style="width:250px; text-align:left;margin-left:0; height: 0,1">
<p
style="line-height: 1.2; font-size: x-small; color: rgb(93, 93, 95);">
MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany<br>
Commercial register: HRB 8901<br>
Register Court: Amtsgericht Darmstadt<br>
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz<br>
Chairman of the Supervisory Board: Dr. Thomas Milde<br>
<br>
This email may contain confidential and/or privileged
information. If you are not the correct recipient or have
received this email in error, <br>
please inform the sender immediately and delete this
email.Unauthorised copying or distribution of this email is
not permitted.<br>
<br>
Data protection information: <a
href="https://www.mtg.de/en/privacy-policy"
title="MTG Privacy policy" target="_blank">Privacy policy</a>
</p>
</div>
</div>
</body>
</html>