/ 
Crypt-Perl-0.13
River stage one • 3 direct dependents • 4 total dependents
/ Crypt::Perl::PK
Security Advisories (2)
CVE-2020-17478 (2020-08-10)

ECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against the EC point multiplication algorithm.

CVE-2020-13895 (2020-06-07)

Crypt::Perl::ECDSA in the Crypt::Perl (aka p5-Crypt-Perl) module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s are small and when s = 1. This happens when using the curve secp256r1 (prime256v1). This could conceivably have a security-relevant impact if an attacker wishes to use public r and s values when guessing whether signature verification will fail.

NAME

Crypt::Perl::PK - Public-key cryptography logic

SYNOPSIS

#Will be an instance of the appropriate Crypt::Perl key class,
#i.e., one of:
#
#   Crypt::Perl::RSA::PrivateKey
#   Crypt::Perl::RSA::PublicKey
#   Crypt::Perl::ECDSA::PrivateKey
#   Crypt::Perl::ECDSA::PublicKey
#
my $key_obj = Crypt::Perl::PK::parse_jwk( { .. } );

#Likewise. Feed it public or private, DER or PEM format,
#RSA or ECDSA.
my $key_obj = Crypt::Perl::PK::parse_key( $octet_string );

DISCUSSION

As of now there’s not much of interest to find here except parsing of JWKs.