diff --git a/java/com/google/security/wycheproof/TestUtil.java b/java/com/google/security/wycheproof/TestUtil.java index 7202bdc..bd81036 100644 --- a/java/com/google/security/wycheproof/TestUtil.java +++ b/java/com/google/security/wycheproof/TestUtil.java @@ -93,7 +93,7 @@ public class TestUtil { Provider provider = (Provider) Class.forName(className).getConstructor().newInstance(); Security.insertProviderAt(provider, 1); } - + public static void printJavaInformation() { System.out.println("Running with: "); System.out.println(" java.runtime.name: " + System.getProperty("java.runtime.name")); diff --git a/java/com/google/security/wycheproof/testcases/EcdhTest.java b/java/com/google/security/wycheproof/testcases/EcdhTest.java index 9bcfb1d..8737066 100644 --- a/java/com/google/security/wycheproof/testcases/EcdhTest.java +++ b/java/com/google/security/wycheproof/testcases/EcdhTest.java @@ -57,10 +57,6 @@ import org.junit.runners.JUnit4; *
Adrian Antipa, Daniel Brown, Alfred Menezes, Rene Struik, and Scott Vanstone, "Validation of * Elliptic Curve Public Keys", PKC 2003, https://www.iacr.org/archive/pkc2003/25670211/25670211.pdf * - *
Tibor Jager, Jörg Schwenk, Juraj Somorovsky, "Practical Invalid Curve Attacks on TLS-ECDH", - * ESORICS'15, https://www.nds.rub.de/research/publications/ESORICS15/ - * (describes attacks on BouncyCastle and SunEC) - * *
Bugs: CVE-2015-7940: BouncyCastle before 1.51 does not validate a point is on the * curve. BouncyCastle v.1.52 checks that the public key point is on the public key curve but does * not check whether public key and private key use the same curve. BouncyCastle v.1.53 is still @@ -68,7 +64,7 @@ import org.junit.runners.JUnit4; * used by the public key. ECDHC would then reduce the private key modulo this order, which can be * used to find the private key. * - *
CVE-2015-6924: Utimaco HSMs vulnerable to invalid curve attacks, which made the private key + *
CVE-2015-6924: Utimaco HSMs vulnerable to invalid curve attacks, which made the private key * extraction possible. * *
CVE-2015-7940: Issue with elliptic curve addition in mixed Jacobian-affine coordinates