Bouncy Castle and the Impact of Cryptographic Vulnerabilities

This article has been indexed from DZone Security Zone

In December 2020, a vulnerability in the Bouncy Castle cryptographic library was publicly revealed. This vulnerability was discovered in October and fixed in November 2020. However, the nature of supply chain vulnerabilities means that many organizations remain vulnerable months later.

Inside the Bouncy Castle Vulnerability

The Bouncy Castle vulnerability was a flaw in the implementation of the OpenBSDBcrypt.doCheckPassword() function. The purpose of this function is to compare the hash of a password submitted during user authentication with a hash stored by the system. If these hashes match, then the user authenticates successfully.

Read the original article: Bouncy Castle and the Impact of Cryptographic Vulnerabilities