Signature forgery attack

As explained in Real-World Cryptography

A signature forgery attack is an attack that produces a signature a verifier accepts without knowledge of the legitimate signer's private key.

Imagine a verifier approving a message signed by someone who never signed it. A signature forgery attack creates an accepted signature without the legitimate signer's private key. For RSA PKCS#1 v1.5, the attack targets flawed implementations of signature verification rather than correctly implemented mathematics. section 7.3.1

The RSA PKCS#1 v1.5 failure pattern is:

• The signer hashes and pads a message, then applies the private exponent; the verifier applies the public exponent and checks the padded hash. section 7.3.1
• A verifier that misimplements the standard may accept a forged result, enabling variants of Bleichenbacher's attack. section 7.3.1
• Use caution when retaining RSA PKCS#1 v1.5 for backward compatibility; RSA signatures as a whole are not thereby insecure. section 7.3.1

Figure 7.9 RSA PKCS#1 v1.5 for signatures. To sign, hash then pad the message with the PKCS#1 v1.5 padding scheme. The final step exponentiates the padded hashed message with the private key d modulo N. To verify, simply exponentiate the signature with the public exponent e modulo N and verify that it matches the padded and hashed message.

Trace the hash, padding, private-key signing, public-key verification, and matching steps behind the attack surface. section 7.3.1

How Real-World Cryptography covers it

How deep it goes

Explains the threat and implementation distinction, but stops short of constructing the forgery or detailing attack variants.

Examples

Uses RSA signing and verification diagrams plus Bleichenbacher's attack and misimplemented open-source verifiers as examples.

What you can do after

Evaluate RSA PKCS#1 v1.5 deployments and treat backward compatibility as a reason for heightened caution.

How it connects

Connects RSA PKCS#1 v1.5 signatures with RSA-PSS, RSA encryption, hashing, padding, and signature verification.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Hacking CryptographyA signature forgery attack attempts to create a valid signature for data without authorization from the holder of the signing private key.

Compare how 2 books explain signature forgery attack →

Related concepts

• rsaes-pkcs1-v1_5uses · RSAES-PKCS1-v1_5 is a PKCS #1 standard RSA encryption scheme that formats messages with type 2 padding before encryption.
• Bleichenbacher's e=3 forgery attackincludes · Bleichenbacher's e=3 forgery attack is an RSA signature-forgery attack that exploits lax validation of PKCS #1 v1.5 signature padding when the public exponent is 3.
• digital signatureaddressed by · A digital signature is cryptographic data generated with a private key and verified with corresponding public information to authenticate data or its signer and detect alteration.
• selective forgery attackincludes · A selective forgery attack enables an attacker to forge valid signatures for messages satisfying specified constraints.
• existential forgery attackincludes · An existential forgery attack produces at least one valid message-signature pair without the attacker needing to choose the message in advance or possess the signing secret.
• universal forgery attackincludes · A universal forgery attack enables an attacker to forge valid signatures for arbitrary attacker-chosen messages.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.