Re: [saag] NSA bug in Windows 10

[Viktor Dukhovni <[e-mail]>]

On Fri, Jan 17, 2020 at 01:07:19PM -0500, Phillip Hallam-Baker wrote:

> OK so the attack seems to be
> 
> Root cert specifies Key A = {CurveA, PointA}

In particular, the curve coefficients, the curve *generator* and the
root CA's public key (point).

> Root cert signs subordinate cert creating signature {CurveA, PointB}

The attacker creates a fake root cert with a different *generator*,
the simplest case is 'generator == public point, private key = 1'.

> Mallet can now generate a new signature {CurveM, PointB} which will
> validate because the pathmath isn't checking the domain params, only the
> curve point.

Mallet can generate any desired certificate chain with the new root
CA key.  No need to match anything pre-existing.  The new chains
will pass validation.

-- 
    Viktor.