I am analyzing the impact of CVE-2016-1000341 having CVSS score 7.5 and description "DSA signature generation vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55 or earlier, may allow an attacker to gain information about the signatures k value and ultimately the private value as well.". It is acknowledged by BouncyCastle here: https://www.bouncycastle.org/releasenotes.html.
I am confused by the line: "DSA signature generation vulnerable to timing attack". While I understand what is timing attack, I am confused by the clause "DSA signature generation". What is the precise meaning of this term? Which of the following two or something else is true?
- If an application is digitally signing and verifying data with the BouncyCastle library using public/private key, is it vulnerable due to this vulnerability? OR
- Does "DSA signature generation" mean generating private and public key that are used in digital signature validation?
Any guidance here would be greatly appreciated!
Kind regards, Shashi