Re: BoringSSL private key loading is not constant time

[Jeffrey Walton <noloader () gmail com>]

On Mon, Oct 13, 2025 at 1:25 PM Billy Brumley <bbb () iki fi> wrote:
> Howdy Folks,
>
> I spoke at the OpenSSL Conference in Prague last week, where I stepped
> through the following demo I wrote
>
> https://gitlab.com/platsec/boringssl-keyload-vuln
>
> This was on BoringSSL main HEAD. (At the time, at least.)
>
> Here "constant time" is in the cryptographic sense. Time to load a private
> key should not depend on bits of said key taking certain values, yet it
> does in BoringSSL's implementation. Constant-time crypto code seems to be
> important to BoringSSL / Google.

Forgive my ignorance... I only visited the forge and read the README
(+1 on the additional terms for DJT).

What does the attacker learn besides the key length?  Isn't that
mostly public information, like the TLS options used during cipher
suite negotiation?

Is there an actual private key recovery associated with the attack?  I
did not see it in the sources I examined.

And how does one get a server to repeatedly load a private key that is
usually loaded once on server startup?

Finally, how does an attacker change a server's governor, like from
userspace or conservative to performance?

Jeff