A Decade After Bleichenbacher '06, RSA Signature Forgery Still Works
summary
Researchers use dynamic symbolic execution to generate concolic tests and extract verification formulas, releasing the toolchain and artifacts. The analysis covers 15 implementations, finds 6 overly lenient libraries and 4 that allow practical RSA-1.5 signature forgery (notably OpenSwan, strongSwan, xtls variants), produces 6 CVEs (3 high, 3 medium), and yields working forgery generators that exploit small public exponent deployments (e=3) and unit-testable fixes that vendors quickly accept.
AI-written summary · about
chapters (16)
- 0:00Intro
- 2:31Textbook RSA signature
- 3:11Beyond textbook RSA
- 4:15PKCS#1 v1.5 Signature Scheme
- 6:48Bleichenbacher's low exponent attack
- 10:12A little brain teaser
- 10:23Why was the attack possible?
- 11:03To find these attacks
- 11:25Automatically generate concolic test cases
- 12:18Testing with Symbolic Execution
- 12:48Implementations Tested
- 13:20Leniency in Openswan 2.6.50
- 14:07New unit test in Openswan
- 14:28Leniency in strongSwan 5.6.3
- 15:41strongSwan Security Update
- 19:37Lessons Learned
related talks
39mWhen Is a Proof Actually Not?
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
51mA Retrospective on the Use of Export Cryptography
42mRecover a RSA Private Key From a TLS Session With Perfect Forward Secrecy
28mThe Million-Key Question—Investigating the Origins of RSA Public Keys
36mThe Art & Craft of Secrets: Using the Cryptographic Toolbox
12mAchilles: A Formal Framework of Leaking Secrets from Signature Schemes via...
01h 26mTLS Cryptography for Programmers