The cr.yp.to microblog: 2024.03.14 06:41:16

2024.03.14 06:41:16 (Mastodon 112092674555296761, Twitter 1768165491963740406) from Daniel J. Bernstein:

Fun fact noted in the code: if you change first 0x30 in openssl_ed25519_lib25519.c to, say, 0x31 then the edtest script triggers double-free in the OpenSSL core when it calls openssl req. String contents corrupting pointer structures! Hopefully never attacker-influenced strings.