To clarify the Windows crypto fail: The problem isn't in signature validation. The problem is the *root store/cache*. CryptoAPI considers an (attacker-supplied) root CA to be in the trust store if its public key and serial match a cert in the root store, Ignoring curve params.
-
-
Would you mind ELI5 or link to an article which isn't crap? To me it sounds a bit like bruteforcing a private key from a public one.
-
The public key is the curve base point times the private key. This is secure because multiplication in ECC is like a hash, it's not easily invertible. If you can change the base point, you just set the private key to 1 and the base point to whatever public key you want.
Kraj razgovora
Novi razgovor -
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.