Mailinglist Archive: opensuse-commit (1262 mails)
| < Previous | Next > |
commit perl-Crypt-CBC
- From: root@xxxxxxx (h_root)
- Date: Sun, 17 Sep 2006 00:58:21 +0200 (CEST)
- Message-id: <20060916225821.CDD8318C5A7@xxxxxxxxxxxxxxx>
Hello community,
here is the log from the commit of package perl-Crypt-CBC
checked in at Sun Sep 17 00:58:21 CEST 2006.
--------
--- perl-Crypt-CBC/perl-Crypt-CBC.changes 2006-07-14 09:04:33.000000000 +0200
+++ perl-Crypt-CBC/perl-Crypt-CBC.changes 2006-09-15 19:45:53.000000000 +0200
@@ -1,0 +2,7 @@
+Thu Sep 14 12:18:51 CEST 2006 - anicka@xxxxxxx
+
+- update to 2.19
+ * Renamed Crypt::CBC-2.16-vulnerability.txt so that
+ package installs correctly under Cygwin
+
+-------------------------------------------------------------------
Old:
----
Crypt-CBC-2.18.tar.bz2
New:
----
Crypt-CBC-2.19.tar.bz2
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ perl-Crypt-CBC.spec ++++++
--- /var/tmp/diff_new_pack.RBuGfM/_old 2006-09-17 00:57:58.000000000 +0200
+++ /var/tmp/diff_new_pack.RBuGfM/_new 2006-09-17 00:57:58.000000000 +0200
@@ -1,5 +1,5 @@
#
-# spec file for package perl-Crypt-CBC (Version 2.18)
+# spec file for package perl-Crypt-CBC (Version 2.19)
#
# Copyright (c) 2006 SUSE LINUX Products GmbH, Nuernberg, Germany.
# This file and all modifications and additions to the pristine
@@ -13,7 +13,7 @@
Name: perl-Crypt-CBC
URL: http://cpan.org/modules/by-module/Crypt/
BuildRequires: perl-Crypt-Blowfish perl-Crypt-DES
-Version: 2.18
+Version: 2.19
Release: 1
Requires: perl-Crypt-Blowfish perl-Crypt-DES
Requires: perl = %{perl_version}
@@ -55,6 +55,10 @@
/var/adm/perl-modules/%{name}
%changelog -n perl-Crypt-CBC
+* Thu Sep 14 2006 - anicka@xxxxxxx
+- update to 2.19
+ * Renamed Crypt::CBC-2.16-vulnerability.txt so that
+ package installs correctly under Cygwin
* Fri Jul 14 2006 - anicka@xxxxxxx
- update to 2.18
* added lots of documentation
++++++ Crypt-CBC-2.18.tar.bz2 -> Crypt-CBC-2.19.tar.bz2 ++++++
diff -urN --exclude=CVS --exclude=.cvsignore --exclude=.svn --exclude=.svnignore old/Crypt-CBC-2.18/CBC.pm new/Crypt-CBC-2.19/CBC.pm
--- old/Crypt-CBC-2.18/CBC.pm 2006-06-07 01:15:27.000000000 +0200
+++ new/Crypt-CBC-2.19/CBC.pm 2006-08-12 21:49:12.000000000 +0200
@@ -4,7 +4,7 @@
use Carp;
use strict;
use vars qw($VERSION);
-$VERSION = '2.18';
+$VERSION = '2.19';
use constant RANDOM_DEVICE => '/dev/urandom';
diff -urN --exclude=CVS --exclude=.cvsignore --exclude=.svn --exclude=.svnignore old/Crypt-CBC-2.18/Changes new/Crypt-CBC-2.19/Changes
--- old/Crypt-CBC-2.18/Changes 2006-01-10 00:27:49.000000000 +0100
+++ new/Crypt-CBC-2.19/Changes 2006-08-12 21:49:12.000000000 +0200
@@ -1,4 +1,11 @@
Revision history for Perl extension Crypt::CBC.
+2.19 Tue Jul 18 18:39:57 EDT 2006
+ - Renamed Crypt::CBC-2.16-vulnerability.txt so that package installs correctly under
+ Cygwin
+
+2.18 2006/06/06 23:17:04
+ - added more documentation describing how to achieve compatibility with old encrypted messages
+
2.17 Mon Jan 9 18:22:51 EST 2006
-IMPORTANT NOTE: Versions of this module prior to 2.17 were incorrectly
using 8 byte IVs when generating the old-style RandomIV style header
diff -urN --exclude=CVS --exclude=.cvsignore --exclude=.svn --exclude=.svnignore old/Crypt-CBC-2.18/Crypt-CBC-2.16-vulnerability.txt new/Crypt-CBC-2.19/Crypt-CBC-2.16-vulnerability.txt
--- old/Crypt-CBC-2.18/Crypt-CBC-2.16-vulnerability.txt 1970-01-01 01:00:00.000000000 +0100
+++ new/Crypt-CBC-2.19/Crypt-CBC-2.16-vulnerability.txt 2006-07-19 00:39:26.000000000 +0200
@@ -0,0 +1,119 @@
+Perl Module Security Advisory
+
+-------------------------------------------------------------------------------
+ Title: Crypt::CBC ciphertext weakness when using certain block algorithms
+Severity: High
+Versions: All versions <= 2.16.
+ Date: 16 February 2006
+-------------------------------------------------------------------------------
+
+Synopsis
+--------
+
+The Perl Crypt::CBC module versions through 2.16 produce weak
+ciphertext when used with block encryption algorithms with blocksize >
+8 bytes.
+
+Background
+----------
+
+Crypt::CBC implements the Cipher Block Chaining Mode (CBC) [1]. CBC
+allows block ciphers (which encrypt and decrypt chunks of data of a
+fixed block length) to act as though they are stream ciphers capable
+of encrypting and decrypting arbitrary length streams. It does this by
+randomly generating an initialization vector (IV) the same length as
+the cipher's block size. This IV is logically XORed with the first
+block of plaintext prior to encryption. The block is encrypted, and
+the result is used as the IV applied to the next block of plaintext.
+This process is repeated for each block of plaintext.
+
+In order for ciphertext encrypted by Crypt::CBC to be decrypted, the
+receiver must know both the key used to encrypt the data stream and
+the IV that was chosen. Because the IV is not secret, it can safely be
+appended to the encrypted message. The key, of course, is kept in a
+safe place and transmitted to the recipient by some secure means.
+
+Crypt::CBC can generate two types of headers for transmitting the
+IV. The older, deprecated, header type is known as the "RandomIV"
+header, and consists of the 8 byte string "RandomIV" followed by 8
+bytes of IV data. This is the default header generated by Crypt::CBC
+versions through 2.16. The newer, recommended, type of header is known
+as the "Salted" header and consists of the 8 byte string "Salted__"
+followed by an 8 byte salt value. The salt value is used to rederive
+both the encryption key and the IV from a long passphrase provided by
+the user. The Salted header was introduced in version 2.13 and is
+compatible with the CBC header generated by OpenSSL [2].
+
+
+Description
+-----------
+
+The RandomIV style header assumes that the IV will be exactly 8 bytes
+in length. However, the IV must be the same length as the underlying
+cipher's block size, and so this assumption is not correct when using
+ciphers whose block size is greater than 8 bytes. Of the ciphers
+commonly available to Perl developers, only the Rijndael algorithm,
+which uses a 16 byte block size is the primary cipher affected by this
+issue. Rijndael is the cipher that underlies the AES encryption
+standard.
+
+Impact
+------
+
+Ciphertext encrypted with Crypt::CBC using the legacy RandomIV header
+and the Rijndael cipher is not secure. The latter 8 bytes of each
+block are chained using a constant effective IV of null, meaning that
+the ciphertext will be prone to differential cryptanalysis,
+particularly if the same key was used to generate multiple encrypted
+messages. Other >8-byte cipher algorithms will be similarly affected.
+
+The difficulty of breaking data encrypted using this flawed algorithm
+is unknown, but it should be assumed that all information encrypted in
+this way has been, or could someday be, compromised.
+
+Exploits
+--------
+
+There are no active exploits known at this time.
+
+Workaround
+----------
+
+If using Crypt::CBC versions 2.16 and lower, pass the -salt=>1 option
+to Crypt::CBC->new(). This will generate and process IVs correctly for
+ciphers of all length.
+
+Resolution
+----------
+
+Upgrade to Crypt::CBC version 2.17 or higher. This module makes the
+Salted header the default behavior and refuses to encrypt or decrypt
+with non-8 byte block size ciphers when in legacy RandomIV mode.
+
+In order to decrypt ciphertext previously encrypted by pre-2.17
+versions of the software with Rijndael and other >8-byte algorithms,
+Crypt::CBC provides an -insecure_legacy_decrypt option that will allow
+such ciphertext to be decrypted. The default is to refuse to decrypt
+such data.
+
+The most recent version of Crypt::CBC can be downloaded from the
+Comprehensive Perl Archive Network (CPAN; http://www.cpan.org).
+
+Contact
+-------
+
+For further information about this issue, please contact the author of
+Crypt::CBC, Lincoln Stein <lstein@xxxxxxxx>.
+
+Acknowledgements
+----------------
+
+The author gratefully acknowledges the contribution of Ben
+Laurie<ben@xxxxxxxxxxxxx>, who correctly identified the issue and
+suggested the resolution.
+
+References
+----------
+
+[1] http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation
+[2] http://www.openssl.org/
diff -urN --exclude=CVS --exclude=.cvsignore --exclude=.svn --exclude=.svnignore old/Crypt-CBC-2.18/Crypt::CBC-2.16-vulnerability.txt new/Crypt-CBC-2.19/Crypt::CBC-2.16-vulnerability.txt
--- old/Crypt-CBC-2.18/Crypt::CBC-2.16-vulnerability.txt 2006-02-16 17:56:14.000000000 +0100
+++ new/Crypt-CBC-2.19/Crypt::CBC-2.16-vulnerability.txt 1970-01-01 01:00:00.000000000 +0100
@@ -1,119 +0,0 @@
-Perl Module Security Advisory
-
--------------------------------------------------------------------------------
- Title: Crypt::CBC ciphertext weakness when using certain block algorithms
-Severity: High
-Versions: All versions <= 2.16.
- Date: 16 February 2006
--------------------------------------------------------------------------------
-
-Synopsis
---------
-
-The Perl Crypt::CBC module versions through 2.16 produce weak
-ciphertext when used with block encryption algorithms with blocksize >
-8 bytes.
-
-Background
-----------
-
-Crypt::CBC implements the Cipher Block Chaining Mode (CBC) [1]. CBC
-allows block ciphers (which encrypt and decrypt chunks of data of a
-fixed block length) to act as though they are stream ciphers capable
-of encrypting and decrypting arbitrary length streams. It does this by
-randomly generating an initialization vector (IV) the same length as
-the cipher's block size. This IV is logically XORed with the first
-block of plaintext prior to encryption. The block is encrypted, and
-the result is used as the IV applied to the next block of plaintext.
-This process is repeated for each block of plaintext.
-
-In order for ciphertext encrypted by Crypt::CBC to be decrypted, the
-receiver must know both the key used to encrypt the data stream and
-the IV that was chosen. Because the IV is not secret, it can safely be
-appended to the encrypted message. The key, of course, is kept in a
-safe place and transmitted to the recipient by some secure means.
-
-Crypt::CBC can generate two types of headers for transmitting the
-IV. The older, deprecated, header type is known as the "RandomIV"
-header, and consists of the 8 byte string "RandomIV" followed by 8
-bytes of IV data. This is the default header generated by Crypt::CBC
-versions through 2.16. The newer, recommended, type of header is known
-as the "Salted" header and consists of the 8 byte string "Salted__"
-followed by an 8 byte salt value. The salt value is used to rederive
-both the encryption key and the IV from a long passphrase provided by
-the user. The Salted header was introduced in version 2.13 and is
-compatible with the CBC header generated by OpenSSL [2].
-
-
-Description
------------
-
-The RandomIV style header assumes that the IV will be exactly 8 bytes
-in length. However, the IV must be the same length as the underlying
-cipher's block size, and so this assumption is not correct when using
-ciphers whose block size is greater than 8 bytes. Of the ciphers
-commonly available to Perl developers, only the Rijndael algorithm,
-which uses a 16 byte block size is the primary cipher affected by this
-issue. Rijndael is the cipher that underlies the AES encryption
-standard.
-
-Impact
-------
-
-Ciphertext encrypted with Crypt::CBC using the legacy RandomIV header
-and the Rijndael cipher is not secure. The latter 8 bytes of each
-block are chained using a constant effective IV of null, meaning that
-the ciphertext will be prone to differential cryptanalysis,
-particularly if the same key was used to generate multiple encrypted
-messages. Other >8-byte cipher algorithms will be similarly affected.
-
-The difficulty of breaking data encrypted using this flawed algorithm
-is unknown, but it should be assumed that all information encrypted in
-this way has been, or could someday be, compromised.
-
-Exploits
---------
-
-There are no active exploits known at this time.
-
-Workaround
-----------
-
-If using Crypt::CBC versions 2.16 and lower, pass the -salt=>1 option
-to Crypt::CBC->new(). This will generate and process IVs correctly for
-ciphers of all length.
-
-Resolution
-----------
-
-Upgrade to Crypt::CBC version 2.17 or higher. This module makes the
-Salted header the default behavior and refuses to encrypt or decrypt
-with non-8 byte block size ciphers when in legacy RandomIV mode.
-
-In order to decrypt ciphertext previously encrypted by pre-2.17
-versions of the software with Rijndael and other >8-byte algorithms,
-Crypt::CBC provides an -insecure_legacy_decrypt option that will allow
-such ciphertext to be decrypted. The default is to refuse to decrypt
-such data.
-
-The most recent version of Crypt::CBC can be downloaded from the
-Comprehensive Perl Archive Network (CPAN; http://www.cpan.org).
-
-Contact
--------
-
-For further information about this issue, please contact the author of
-Crypt::CBC, Lincoln Stein <lstein@xxxxxxxx>.
-
-Acknowledgements
-----------------
-
-The author gratefully acknowledges the contribution of Ben
-Laurie<ben@xxxxxxxxxxxxx>, who correctly identified the issue and
-suggested the resolution.
-
-References
-----------
-
-[1] http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation
-[2] http://www.openssl.org/
diff -urN --exclude=CVS --exclude=.cvsignore --exclude=.svn --exclude=.svnignore old/Crypt-CBC-2.18/MANIFEST new/Crypt-CBC-2.19/MANIFEST
--- old/Crypt-CBC-2.18/MANIFEST 2006-06-07 01:16:48.000000000 +0200
+++ new/Crypt-CBC-2.19/MANIFEST 2006-08-12 21:50:00.000000000 +0200
@@ -4,8 +4,7 @@
META.yml Module meta-data (added by MakeMaker)
Makefile.PL
README
-README.compatibility
-Crypt::CBC-2.16-vulnerability.txt
+Crypt-CBC-2.16-vulnerability.txt
eg/aes.pl
eg/des.pl
eg/idea.pl
diff -urN --exclude=CVS --exclude=.cvsignore --exclude=.svn --exclude=.svnignore old/Crypt-CBC-2.18/META.yml new/Crypt-CBC-2.19/META.yml
--- old/Crypt-CBC-2.18/META.yml 2006-06-07 01:20:33.000000000 +0200
+++ new/Crypt-CBC-2.19/META.yml 2006-08-12 21:50:09.000000000 +0200
@@ -1,7 +1,7 @@
# http://module-build.sourceforge.net/META-spec.html
#XXXXXXX This is a prototype!!! It will change in the future!!! XXXXX#
name: Crypt-CBC
-version: 2.18
+version: 2.19
version_from: CBC.pm
installdirs: site
requires:
diff -urN --exclude=CVS --exclude=.cvsignore --exclude=.svn --exclude=.svnignore old/Crypt-CBC-2.18/README.compatibility new/Crypt-CBC-2.19/README.compatibility
--- old/Crypt-CBC-2.18/README.compatibility 2006-06-07 01:15:10.000000000 +0200
+++ new/Crypt-CBC-2.19/README.compatibility 1970-01-01 01:00:00.000000000 +0100
@@ -1,44 +0,0 @@
-Compatibility Notes
--------------------
-
-Crypt::CBC version 2.17 and higher contains changes designed to make
-encrypted messages more secure. In particular, Crypt::CBC now works
-correctly with ciphers that use block sizes greater than 8 bytes,
-which includes Rijndael, the basis for the AES encryption system. It
-also interoperates seamlessly with the OpenSSL library. Unfortunately,
-these changes break compatibility with messages encrypted with
-versions 2.16 and lower.
-
-To successfully decrypt messages encrypted with Crypt::CBC 2.16 and
-lower, follow these steps:
-
-1) Pass Crypt::CBC->new() the option -header=>'randomiv'. Example:
-
- my $cbc = Crypt::CBC->new(-key => $key,
- -cipher => 'Blowfish',
- -header => 'randomiv');
-
-This tells Crypt::CBC to decrypt messages using the legacy "randomiv"
-style header rather than the default SSL-compatible "salt" style
-header.
-
-2) If the legacy messages were encrypted using Rijndael, also pass
-Crypt::CBC the -insecure_legacy_decrypt=>1 option:
-
- my $cbc = Crypt::CBC->new(-key => $key,
- -cipher => 'Rijndael',
- -header => 'randomiv',
- -insecure_legacy_decrypt => 1 );
-
-
-This tells Crypt::CBC to allow you to decrypt Rijndael messages that
-were incorrectly encrypted by pre-2.17 versions. It is important to
-realize that Rijndael messages encrypted by version 2.16 and lower
-*ARE NOT SECURE*. New versions of Crypt::CBC will refuse to encrypt
-Rijndael messages in a way that is backward compatible with 2.16 and
-lower.
-
-I apologize for any inconvenience this causes.
-
-Lincoln Stein
-Spring 2006
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Remember to have fun...
---------------------------------------------------------------------
To unsubscribe, e-mail: opensuse-commit+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-commit+help@xxxxxxxxxxxx
| < Previous | Next > |