diff --git a/ChangeLog.d/padding-ct-changelog.txt b/ChangeLog.d/padding-ct-changelog.txt index f89f479a7a..e3d3424a98 100644 --- a/ChangeLog.d/padding-ct-changelog.txt +++ b/ChangeLog.d/padding-ct-changelog.txt @@ -1,6 +1,6 @@ Security - * Fix non-constant-time behaviour in padding calculations in CBC - decryption, NIST SP 800-38F key wrapping, and RSAAES-OAEP decryption. - For CBC and RSAAES-OAEP, this may have been exploitable in a - padding oracle for a privileged local attacker with the ability to - observe memory access timings. + * Improve padding calculations in CBC decryption, NIST key unwrapping and + RSA OAEP decryption. With the previous implementation, some compilers + (notably recent versions of Clang) could produce non-constant time code, + which could allow a padding oracle attack if the attacker has access to + precise timing measurements.