#1586 closed defect (somebody else's problem)

"PowmInsecureWarning: Not using mpz_powm_sec" warning from PyCrypto

Reported by: davidsarah Owned by: somebody
Priority: normal Milestone: eventually
Component: packaging Version: 1.9.0b1
Keywords: pycrypto-lib libgmp security sftp Cc:
Launchpad Bug:

Description (last modified by zooko)

This warning occurs when importing PyCrypto 2.4.1 (possibly depending on how the PyCrypto egg for the current platform was built):

/usr/local/lib/python2.6/dist-packages/pycrypto-2.4.1-py2.6-linux-x86_64.egg/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.

We probably just need to accelerate the programme to get rid of our dependency (via Twisted) on PyCrypto: http://twistedmatrix.com/trac/ticket/4633

Change History (10)

comment:1 Changed at 2011-11-17T22:52:27Z by davidsarah

  • Description modified (diff)

comment:2 Changed at 2012-04-01T04:36:31Z by davidsarah

  • Milestone changed from undecided to eventually
  • Priority changed from minor to normal

comment:3 Changed at 2012-05-14T04:10:34Z by david-sarah@…

comment:4 Changed at 2012-05-14T14:53:56Z by david-sarah <david-sarah@…>

comment:5 Changed at 2012-05-14T21:40:43Z by david-sarah@…

comment:6 Changed at 2012-05-15T15:59:54Z by zooko

I reviewed 4b80299fddd7ece4 and saw no problem with it.

comment:7 Changed at 2013-10-10T19:25:47Z by zooko

  • Description modified (diff)
  • Resolution set to fixed
  • Status changed from new to closed

This was apparently fixed by the warning-suppression patch [4b80299fddd7ece4].

comment:8 Changed at 2013-10-17T14:43:19Z by daira

  • Resolution fixed deleted
  • Status changed from closed to reopened

Well, the potential timing vulnerability is not fixed. (It affects only the SFTP frontend, and is documented at SftpFrontend, which I just updated to reflect that PyCrypto 2.4.1 is still vulnerable.)

As the message clearly says, someone "should rebuild [PyCrypto] using libgmp >= 5". Reopening in order to close as "somebody else's problem".

comment:9 Changed at 2013-10-17T14:43:51Z by daira

  • Keywords libgmp security sftp added
  • Resolution set to somebody else's problem
  • Status changed from reopened to closed

comment:10 Changed at 2013-10-17T14:54:30Z by daira

Actually, maybe this is partly our problem after all, since we build the PyCrypto eggs that are hosted at https://tahoe-lafs.org/source/tahoe-lafs/deps/tahoe-dep-eggs. Filed as #2094.

Last edited at 2013-10-17T14:54:59Z by daira (previous) (diff)
Note: See TracTickets for help on using tickets.