Heartbleed Update v3
Willem's letter to Akamai addressed three areas where their patch was likely insufficient:<p>(1) First question is then, are 'p', 'q' and 'd' the only sensitive parameters? NO. (The Chinese Remainder Theorem parameters are included in OpenSSL private keys by default and they are enough to recover the private key).<p>(2) Second question: Does OpenSSL ever copy the private key, or parts, after the key has been read? YES.<p>(3) Third question: Does OpenSSL allocate temporary variables for intermediates when performing operations with a private key.  Can they be used to recover the private key? YES and YES.<p>(Willem's post submitted to HN: <a href="https://news.ycombinator.com/item?id=7582990" rel="nofollow">https://news.ycombinator.com/item?id=7582990</a> )<p>This update from Akamai only addresses (1), AFAICT.