A signature forgery attack creates a message–signature pair that verifies without authorization from the signing private key. Digital signatures should make signing difficult to counterfeit while keeping verification easy. section 9.3 section 9.0
Classify forgery attacks by what the attacker can produce:
- Total break recovers the private key from signatures. section 9.3
- Universal forgery produces valid signatures for arbitrary messages without the private key. section 9.3
- Selective forgery produces valid signatures only for restricted messages or conditions. section 9.3 section 9.6.2
- Existential forgery produces at least one valid message–signature pair, regardless of the message content. section 9.3
A concrete selective forgery targets RSA PKCS #1 v1.5 verification with public exponent 3. The vulnerable verifier checks the 00 01 header, searches for a separator byte, and validates the hash afterward, but ignores whether the intervening bytes are all FF. That parsing gap lets a forged RSA value resemble a valid padded signature. section 9.6.2
Bleichenbacher-style RSA forgery
Construct a prefix cube root preserving 00 01, construct a suffix cube root containing the separator, ASN.1 hash identifier, and digest, then stitch the roots together. Cubing the result preserves the required prefix and suffix while avoiding forbidden zero bytes in the middle. A test using SHA-256 and an RSA key with e=3 shows the insecure verifier accepting the forged signature, while the standard verifier accepts only the legitimate signature. section 9.6.4
Defensive rules:
- Validate every required PKCS #1 v1.5 padding byte instead of merely locating the separator. section 9.6.2
- Prefer a standard signature-verification implementation that does not reproduce the vulnerable parsing behavior. section 9.6.2
