To clarify the Windows crypto fail: The problem isn't in signature validation. The problem is the *root store/cache*. CryptoAPI considers an (attacker-supplied) root CA to be in the trust store if its public key and serial match a cert in the root store, Ignoring curve params.
-
-
Yeah, I do remember some article also mentioning the serial match requirement. But I was just able to spoof a valid code sign certificate and the serial definitely doesn't match with the root cert
-
Does it also work for TLS? Maybe it's different.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.