4 ms·
This is very nice work. For those who are interested in academic work about detecting/preventing such attacks, there have been some recent papers that looked at
by kelnage 6y ago
This is very nice work. For those who are interested in academic work about detecting/preventing such attacks, there have been some recent papers that looked at the formal verifying protocol models [1, 2] to (dis)prove the absence of such vulnerabilities.
1. https://eprint.iacr.org/2019/779 https://eprint.iacr.org/2019/779
2. https://eprint.iacr.org/2020/823 https://eprint.iacr.org/2020/823
- srfilipek 6y agoThe article discusses interoperability issues; it isn't an attack or vulnerability. The issue is that implementations will reject valid signatures.
- kelnage 6y agoYeah, sorry, my wording wasn’t clear. I meant that attacks exist based on not utilising appropriate validation criteria (and, for example, libsodium’s more strict criteria do indeed prevent them).
- laksdjfkasljdf 6y agoWhich attack(s) would that be?
- deleted 6y ago[deleted]