this is too evolved for me to fully comprehend so i am tempted to just trust the patch authors... however, some test cases (either direct ones or instructions on how to set them up) would be useful to 1) ensure the patch prevents impersonations the previous implementation would have allowed, 2) doesn't introduce regressions and 3) cross-test with other clients (notably Jucy).
nothing wrong jumps out in terms of code; some comments on the following would be welcome: a) new locking mechanism; b) DHs of different sizes; c) CryptoManager clean-up (really necessary since the process is exiting? there was none before - does this fix other issues?); d) changes to cert generation; e) the TODO / commented-out code. -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/991342 Title: KEYP Vulnerability Status in DC++: New Bug description: With the current vulnerability with DC++'s current KEYP implementation the underlying issue seems to be this ... [2012-04-26 09:24] <Crise> anyways, the thing with keyp is entirely different problem... which is basically that it only verifies keyp on the peer level certificate and not on the whole chain as it should Crise has stated he has another source who knows the exploit but will not divulge in who he is. To manage notifications about this bug go to: https://bugs.launchpad.net/dcplusplus/+bug/991342/+subscriptions _______________________________________________ Mailing list: https://launchpad.net/~linuxdcpp-team Post to : [email protected] Unsubscribe : https://launchpad.net/~linuxdcpp-team More help : https://help.launchpad.net/ListHelp
