Subject: Re: [saag] NSA bug in Windows 10

From: Daniel Van Geest <[email-masked]>
Date: Fri, 17 Jan 2020 13:37:06 +0000

The best summary I’ve seen is here:
https://blog.trailofbits.com/2020/01/16/exploiting-the-windows-cryptoapi-vulnerability/

In short, a received root was being compared to the trusted root based only on
the public key, but the private key and parameters of the received root was
generated from the trusted public key using Vaudenay.  Then verification was
done using the received root since it was “the same” as the trusted root.

Daniel Van Geest

On 2020-01-17, 6:55 AM, "saag on behalf of Peter Gutmann" <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:

Benjamin Kaduk <[email-masked]<mailto:[email-masked]>> writes:

I remember reading something that involved [...]

Based on, admittedly, zero reading of stuff around this so far (trying to find
some time this weekend), I assume it's of the type covered here:

Digital Signature Schemes with Domain Parameters
https://lasec.epfl.ch/pub/lasec/doc/Vau04b.pdf

Or at least that's one possible vuln that you get from not checking domain
parameters.

Peter.

_______________________________________________
saag mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/saag

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 17 Jan 2020 23:58:37 +0000

>https://blog.trailofbits.com/2020/01/16/exploiting-the-windows-cryptoapi-vulnerability/
 
There's also good summaries here, along with test vectors:

https://github.com/kudelskisecurity/chainoffools
  (text at https://research.kudelskisecurity.com/2020/01/15/cve-2020-0601-the-chainoffools-attack-explained-with-poc)
https://github.com/ollypwn/cve-2020-0601

Peter.