"PowmInsecureWarning: Not using mpz_powm_sec" warning from PyCrypto #1586

New Issue

tahoe-lafs · 2011-11-17T22:50:31Z

davidsarah commented

2011-11-17 22:50:31 +00:00

This warning occurs when importing PyCrypto 2.4.1 (possibly depending on how the PyCrypto egg for the current platform was built):

/usr/local/lib/python2.6/dist-packages/pycrypto-2.4.1-py2.6-linux-x86_64.egg/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.

We probably just need to accelerate the programme to get rid of our dependency (via Twisted) on PyCrypto: http://twistedmatrix.com/trac/ticket/4633

This warning occurs when importing PyCrypto 2.4.1 (possibly depending on how the PyCrypto egg for the current platform was built): ``` /usr/local/lib/python2.6/dist-packages/pycrypto-2.4.1-py2.6-linux-x86_64.egg/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec. You should rebuild using libgmp >= 5 to avoid timing attack vulnerability. ``` We probably just need to accelerate the programme to get rid of our dependency (via Twisted) on PyCrypto: <http://twistedmatrix.com/trac/ticket/4633>

tahoe-lafs added the

labels 2011-11-17 22:50:31 +00:00

tahoe-lafs added this to the undecided milestone 2011-11-17 22:50:31 +00:00

tahoe-lafs added

normal

and removed

minor

labels 2012-04-01 04:36:31 +00:00

tahoe-lafs modified the milestone from undecided to eventually

2012-04-01 04:36:31 +00:00

david-sarah@jacaranda.org commented

2012-05-14 04:10:34 +00:00

In changeset:4b80299fddd7ece4:

Suppress the PowmInsecureWarning from PyCrypto. refs #1586

In changeset:4b80299fddd7ece4: ``` Suppress the PowmInsecureWarning from PyCrypto. refs #1586 ```

david-sarah <david-sarah@jacaranda.org> commented

2012-05-14 14:53:56 +00:00

In changeset:4b80299fddd7ece4:

Suppress the PowmInsecureWarning from PyCrypto. refs #1586

In changeset:4b80299fddd7ece4: ``` Suppress the PowmInsecureWarning from PyCrypto. refs #1586 ```

david-sarah@jacaranda.org commented

2012-05-14 21:40:43 +00:00

In changeset:5649/ticket999-S3-backend:

Suppress the PowmInsecureWarning from PyCrypto. refs #1586

In changeset:5649/ticket999-S3-backend: ``` Suppress the PowmInsecureWarning from PyCrypto. refs #1586 ```

zooko commented

2012-05-15 15:59:54 +00:00

I reviewed changeset:4b80299fddd7ece4 and saw no problem with it.

zooko commented

2013-10-10 19:25:47 +00:00

This was apparently fixed by the warning-suppression patch [4b80299fddd7ece4].

zooko added the

fixed

label 2013-10-10 19:25:47 +00:00

zooko closed this issue

2013-10-10 19:25:47 +00:00

daira commented

2013-10-17 14:43:19 +00:00

Well, the potential timing vulnerability is not fixed. (It affects only the SFTP frontend, and is documented at wiki/SftpFrontend#Security, which I just updated to reflect that PyCrypto 2.4.1 is still vulnerable.)

As the message clearly says, someone "should rebuild [PyCrypto] using libgmp >= 5". Reopening in order to close as "somebody else's problem".

Well, the potential timing vulnerability is not fixed. (It affects only the SFTP frontend, and is documented at [wiki/SftpFrontend#Security](wiki/SftpFrontend#Security), which I just updated to reflect that PyCrypto 2.4.1 is still vulnerable.) As the message clearly says, someone "should rebuild [PyCrypto] using libgmp >= 5". Reopening in order to close as "somebody else's problem".

tahoe-lafs removed the

fixed

label 2013-10-17 14:43:19 +00:00

daira reopened this issue

2013-10-17 14:43:19 +00:00

tahoe-lafs added the

somebody else's problem

label 2013-10-17 14:43:51 +00:00

daira closed this issue

2013-10-17 14:43:51 +00:00

daira commented

2013-10-17 14:54:30 +00:00

Actually, maybe this is partly our problem after all, since we build the PyCrypto eggs that are hosted at https://tahoe-lafs.org/source/tahoe-lafs/deps/tahoe-dep-eggs. Filed as #2094.

Actually, maybe this is partly our problem after all, since we build the PyCrypto eggs that are hosted at <https://tahoe-lafs.org/source/tahoe-lafs/deps/tahoe-dep-eggs>. Filed as #2094.

Sign in to join this conversation.