To clarify the Windows crypto fail: The problem isn't in signature validation. The problem is the *root store/cache*. CryptoAPI considers an (attacker-supplied) root CA to be in the trust store if its public key and serial match a cert in the root store, Ignoring curve params.
-
-
Would you mind ELI5 or link to an article which isn't crap? To me it sounds a bit like bruteforcing a private key from a public one.
-
The public key is the curve base point times the private key. This is secure because multiplication in ECC is like a hash, it's not easily invertible. If you can change the base point, you just set the private key to 1 and the base point to whatever public key you want.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.