News for hackers. Stuff that matters.

A comment on Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]. Parent comment

Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by wbl on Tuesday January 14, 2020 @10:06PM (#22051447)
It's not even that: the AlgorithmIdentifier structure in the SubjectPublicKeyInfo is allowed to contain parameters, the one in the Signature should not. This is arguably a spec bug.
[ Parent | on HN ]
Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by tialaramex on Tuesday January 14, 2020 @10:45PM (#22051607)
There's even a timely question about this to m.d.s.policy as a result of a Mozilla policy revision which spells out byte-by-byte what a conformant AlgorithmIdentifier looks like:

https://groups.google.com/forum/#!topic/mozilla.dev.security...

This gave Ryan a chance to point people at Adam Langley's wise observation that you should not parse things like signatures when you can instead calculate the entire value you expected and then just binary compare - anything that doesn't match is wrong and you needn't care why.

[ Parent | on HN ]