Bleichenbacher ’06 RSA Signature Forgery: What they assume you know

Landon | Dec 17, 2021

In 2006, Daniel Bleichenbacher shared a discovery in an evening session at a cryptography conference: Several implementations of RSA-based PKCS 1 v 1.5 cryptographic signature verification were fatally flawed and susceptible to signature forgery. It is as bad as it sounds. The sad part: The flaw in the signature verification algorithm is that the signature […]

Secure Remote Password Demystified

Landon | Sep 16, 2021

Secure Remote Password (SRP) is a protocol by which a user in a system is able to log in to that system without the system ever knowing or storing the user’s password. Consider this description of the SRP protocol from cryptopals challenge 36: Replace A and B with C and S (client & server) C […]

Timing leaks and multi-threading

Landon | Aug 24, 2021

What if the server that verified MACs took longer to verify a correct mac than an incorrect one? Or, perhaps put differently, what if you could tell the difference between a more correct guess than an obviously wrong one? If you can, you can break MAC authentication schemes, and that’s what the cryptopals authors are […]