Re: [saag] NSA bug in Windows 10

[Phillip Hallam-Baker <[e-mail]>]

On Thu, Jan 16, 2020 at 11:02 PM Benjamin Kaduk <[e-mail]> wrote:

> On Thu, Jan 16, 2020 at 04:40:41PM +0000, Dan Brown wrote:
> > Based on what I hear others say online, I presume this bug resulted a
> > relying party using details of a received root certificate instead of a
> > details in the true trusted root certificate.
> >
> > https://www.rfc-editor.org/rfc/rfc3280#section-6.1.1
> > item (d), (4) talks about parameters in the trust anchor certificate, and
> > the next paragraph talks about a "delivered ... trustworthy out-of-band".
> >
> > If my presumption above is correct, then it seems that this part of
> RFC3280
> > was not followed in this bug, since the parameters were taken from an
> > untrustworthy in-band delivery.   That said, I wonder if RFC3280
> adequately
> > emphasized this point? Could it have used a MUST?
>
> I remember reading something that involved taking an existing signature
> made by a trusted root from a legitimate certificate issued by that root,
> and re-using that signature with different domain parameters.  That would
> seem to imply that the trusted root is properly being used, but the
> validation code for the signatures in the chain was flawed.
>
> -Ben
>

OK so the attack seems to be

Root cert specifies Key A = {CurveA, PointA}

Root cert signs subordinate cert creating signature {CurveA, PointB}

Mallet can now generate a new signature {CurveM, PointB} which will
validate because the pathmath isn't checking the domain params, only the
curve point.

OMG we are doomed.