The Patching Friars' AlmanacA calendar of CVE saints

August 15

DragonbloodHoly card for dragonblood, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 Dragonblood SANGUIS DRACONIS
🤖 Image and text generated with AI

⬇ Download holy card: ·

⚔ Commemorated today: The Scourge of Shamoon (2012)

Embed on your site

Saint Dragonblood, in Whose Blood WPA3 Was Born

Patron of Wi-Fi networks, cryptographic handshakes, and elliptic curves with exotic names.

Life

In April 2019 Mathy Vanhoef and Eyal Ronen showed that Dragonfly, the handshake at the heart of the new WPA3, suffered from side channels and downgrade attacks that made it possible to guess the Wi-Fi password. In August of the same year they came back with new flaws in the very fixes: with Brainpool curves, hostapd, wpa_supplicant and FreeRADIUS still leaked information through their timing. The dragon had been wounded, not slain.

Prayer

O Saint Dragonblood, who bleeds from every handshake, let our access points always compute in the same amount of time. Amen.

How to celebrate

Celebrated by updating hostapd and wpa_supplicant to 2.9 and choosing a Wi-Fi password no dragon could guess.

A wounded dragon is not a dead one.

Technical record

Disclosed on
August 15 2019
CVE
CVE-2019-13377CVE-2019-13456

The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache access patterns when Brainpool curves are used. An attacker may be able to gain leaked information from a side-channel attack that can be used for full password recovery.

Sources: wpa3.mathyvanhoef.com

Commemorated today

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.