4 ms·

> The former hasn't been broken and is still pretty solid. Most internet certificates are signed using RSA PKCS#1v1.5 I believe. FYI, RSA PKCS#1v1.5 signatures

> The former hasn't been broken and is still pretty solid. Most internet certificates are signed using RSA PKCS#1v1.5 I believe. FYI, RSA PKCS#1v1.5 signatures can be broken due to trivial implementation errors. [1] [1]: https://www.cs.purdue.edu/homes/schau/files/pkcs1v1_5-ndss19.pdf https://www.cs.purdue.edu/homes/schau/files/pkcs1v1_5-ndss19...

baby 7y ago
Thanks! I hadn't seen that paper :) From a cursory glance, all of these implementations are in C it seems like a C systemic issue, not an issue with RSA. But I might be wrong because I've yet to read the paper.
- xucheng 7y ago
  The issues are not due to C but rather failing to verify the PKCS#1v1.5 format. For example, skip verifying the padding or metadata, etc. This allows to insert garbage data in the signatures which leads to successful signature forging.
- tptacek 7y ago
  I'm confident you were aware of the bug in that paper, David, since it's just the e=3 cube-root attack on unvalidated P1v15 padding.
  - baby 7y ago
    Are you talking about the broadcast attack? This is on signatures, and it seems different from bleichenbacher's signature forgery. (But again, haven't read the paper, also don't remember how bb signature forgery works) (I'll read the paper but right now I'm in Hawaii doing snorkeling)
    - tptacek 7y ago
      This is in Cryptopals! You were a Cryptopal! How did you get through that without implementing the e=3 sig attack? The bug is straightforward: RSA implementations don't verify all the bits in the padding, but rather "parse" it to find the digest, and then verify that. But there are, of course, bajillions of potential padded signature block representations that contain any given digest, since the block is so much bigger than the digest. For e=3, and for particularly naive implementations (like Firefox's, at the time) you can almost literally just formulate the signature block you want, then take its cube root to forge a signature.
      - baby 7y ago
        Oh right. Thanks for the reminder :) Sorry to disapoint I did not do all the cryptopals :P filippo actually has a good blogpost on that attack IIRC.
        tptacek 7y ago
        You have, in fact, disappointed me! :| (There are some set-7 problems I haven't done yet, for whatever that's worth. But e=3 sigs are a big one!)
        baby 7y ago
        Alright I will do it :D
        tptacek 7y ago
        Honestly, if you can find a broken implementation (or just write one; do the RSA "decrypt" of the signature block, and then just use a constant offset to get to the digest bytes), you should be able to knock it out just from the description I provided in like, 30 minutes.

baby 7y ago

Thanks! I hadn't seen that paper :) From a cursory glance, all of these implementations are in C it seems like a C systemic issue, not an issue with RSA. But I might be wrong because I've yet to read the paper.

xucheng 7y ago
The issues are not due to C but rather failing to verify the PKCS#1v1.5 format. For example, skip verifying the padding or metadata, etc. This allows to insert garbage data in the signatures which leads to successful signature forging.
tptacek 7y ago
I'm confident you were aware of the bug in that paper, David, since it's just the e=3 cube-root attack on unvalidated P1v15 padding.
- baby 7y ago
  Are you talking about the broadcast attack? This is on signatures, and it seems different from bleichenbacher's signature forgery. (But again, haven't read the paper, also don't remember how bb signature forgery works) (I'll read the paper but right now I'm in Hawaii doing snorkeling)
  - tptacek 7y ago
    This is in Cryptopals! You were a Cryptopal! How did you get through that without implementing the e=3 sig attack? The bug is straightforward: RSA implementations don't verify all the bits in the padding, but rather "parse" it to find the digest, and then verify that. But there are, of course, bajillions of potential padded signature block representations that contain any given digest, since the block is so much bigger than the digest. For e=3, and for particularly naive implementations (like Firefox's, at the time) you can almost literally just formulate the signature block you want, then take its cube root to forge a signature.
    - baby 7y ago
      Oh right. Thanks for the reminder :) Sorry to disapoint I did not do all the cryptopals :P filippo actually has a good blogpost on that attack IIRC.
      - tptacek 7y ago
        You have, in fact, disappointed me! :| (There are some set-7 problems I haven't done yet, for whatever that's worth. But e=3 sigs are a big one!)
        baby 7y ago
        Alright I will do it :D
        tptacek 7y ago
        Honestly, if you can find a broken implementation (or just write one; do the RSA "decrypt" of the signature block, and then just use a constant offset to get to the digest bytes), you should be able to knock it out just from the description I provided in like, 30 minutes.