News for hackers. Stuff that matters.

A comment on Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]. Parent comment

Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by SlowRobotAhead on Tuesday January 14, 2020 @02:51PM (#22048549)
So... Wait, they weren't calculating the signature based on ALL the contents of the cert? There was an "unprotected" section in the cert that allowed for curve details? This seems... too obviously bad.
[ Parent | on HN ]
Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by mzs on Tuesday January 14, 2020 @03:27PM (#22048911)
Basically there are standard curves and software assumed parameters matched, bad design.

edit: more detail

https://news.ycombinator.com/item?id=22048619

[ Parent | on HN ]
Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by SlowRobotAhead on Tuesday January 14, 2020 @09:08PM (#22051173)
Ah I see. It wasn’t that they didn’t secure parts of the cert, it’s that they assumed they didn’t need to add some data. The generator was assumed standard... and surely no one would ever abuse that intention!
[ Parent | on HN ]
Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by bodeadly on Tuesday January 14, 2020 @03:26PM (#22048903)
Not exactly but I'm not sure it matters. It sounds like if the curve parameters are crafted just-so, they can dodge validation and use anyone's public key and yet still negotiate successfully and decrypt everything. The "gramdma" explaination is basically the green lock next to the URL in your browser doesn't mean spit at this particular moment in time.
[ Parent | on HN ]