botan1.10 1.10.5-1 source package in Ubuntu

Changelog

botan1.10 (1.10.5-1) unstable; urgency=low


  * Imported Upstream version 1.10.4
   + Avoid a conditional operation in the power mod implementations on if
     a nibble of the exponent was zero or not. This may help protect
     against certain forms of side channel attacks.
   + The SRP6 code was checking for invalid values as specified in RFC
     5054, specifically values equal to zero mod p. However SRP would
     accept negative A/B values, or ones larger than p, neither of which
     should occur in a normal run of the protocol. These values are now
     rejected. Credits to Timothy Prepscius for pointing out these values
     are not normally used and probably signal something fishy.
   + The return value of version_string is now a compile time constant
     string, so version information can be more easily extracted from
     binaries.
  * Imported Upstream version 1.10.5
   + A potential crash in the AES-NI implementation of the AES-192 key
     schedule (caused by misaligned loads) has been fixed.
   + A previously conditional operation in Montgomery multiplication and
     squaring is now always performed, removing a possible timing channel.
   + Use correct flags for creating a shared library on OS X under Clang.
   + Fix a compile time incompatibility with Visual C++ 2012.

 -- Ondřej Surý <email address hidden>  Mon, 04 Mar 2013 09:24:12 +0100