Re: [bitcoin-dev] Disclosure: consensus bug indirectly solved by BIP66

2015-07-29 Thread Mike Hearn via bitcoin-dev
> > I believe the idea is to replace openSSL with > https://github.com/bitcoin/secp256k1 Yes, I know. I said "other uses". For example RPC SSL and BIP 70. ___ bitcoin-dev mailing list bitcoin-dev@lists.linuxfoundation.org https://lists.linuxfoundation.o

Re: [bitcoin-dev] Disclosure: consensus bug indirectly solved by BIP66

2015-07-29 Thread Adam Back via bitcoin-dev
I believe the idea is to replace openSSL with https://github.com/bitcoin/secp256k1 that Pieter and Greg spent quite some time rigorously testing and have at this point better confidence in than *SSL libraries. I think the lessons learned from it as concluded by Pieter and Greg are that openSSL and

Re: [bitcoin-dev] Disclosure: consensus bug indirectly solved by BIP66

2015-07-29 Thread Mike Hearn via bitcoin-dev
> > This solved the vulnerability, and opens the door to using non-OpenSSL > signature verification in the near future. Great work! It also means the remaining usages of OpenSSL can be safely replaced with something like LibreSSL or (perhaps better) BoringSSL. ___

[bitcoin-dev] Disclosure: consensus bug indirectly solved by BIP66

2015-07-28 Thread Pieter Wuille via bitcoin-dev
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello all, I'd like to disclose a vulnerability I discovered in September 2014, which became unexploitable when BIP66's 95% threshold was reached earlier this month. ## Short description: A specially-crafted transaction could have forked the blockch