RE: BlueZ: How to avoid fixed Coordinate Invalid Curve Attack

[Andy Duan <fugang.duan@xxxxxxx>]

From: Marcel Holtmann <marcel@xxxxxxxxxxxx>  Sent: 2018年8月29日 2:36
> Hi Asim,
> 
> > Is this the patch you are referring to?
> >
> >
> https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fp
> at
> >
> chwork.kernel.org%2Fpatch%2F9976233%2F&amp;data=02%7C01%7Cfug
> ang.duan%
> >
> 40nxp.com%7Cecf4119d601248c249b908d60d15138f%7C686ea1d3bc2
> b4c6fa92cd99
> >
> c5c301635%7C0%7C0%7C636710781507970320&amp;sdata=P%2FqUyE
> RKXofyiCLE%2F
> > TqM8gjcT8T6KIpONidU6A91tcM%3D&amp;reserved=0
> 
> no it is not. The patch you are looking for is this:
> 
> commit ea169a30a6bf6782a05a51d2b9cf73db151eab8b
> Author: Stephan Mueller <smueller@xxxxxxxxxx>
> Date:   Mon Jun 25 12:00:18 2018 +0200
> 
>     crypto: ecdh - add public key verification test
> 
> It follows closely the NIST recommendation for public key remmomen
> Regards
> 
> Marcel

Hi Macel,

Thanks for your information !

For v4.14/v4.9 stable tree,  why does the patch not apply in v4.14,  do you have plan to do backporting to v4.14 stable tree？ 
I plan cherry pick crypto/ecc.c some patch and the patch "crypto: ecdh - add public key verification test " to v4.9 and v4.14 NXP IMX kernel tree.

Andy Duan