RSA 1024位签名几乎在 SNFS 时间内可伪造
问题概述
研究表明，攻击者在拥有公钥并通过RSA操作接口（oracle）的情况下，可在不分解模数的情况下伪造签名，这对使用RSA的签名系统（如代码签名令牌）构成潜在威胁。当前标准（如PKCS）已对部分填充方案提供保护，但实际部署中仍可能因硬件令牌泄露私钥操作而受影响，导致安全性估计下降。
痛点标签
- RSA私钥操作在硬件令牌中暴露导致签名伪造风险
- 现有PKCS标准未覆盖所有填充方案的攻击
- 对RSA安全性估计的下降引发对代码签名的信任担忧
待验证问题
- 您是否使用需要暴露RSA私钥操作的硬件令牌进行代码签名？
- 是否在当前系统中依赖PKCS填充方案？
- 是否需要对RSA安全模型进行重新评估以防止此类攻击？
证据
原话 · @Anonymous
The most important thing to know about this work, which is awesome, is that it relies on access to a raw RSA oracle, where you have a public key and an API that allows you to directly do RSA operations with the corresponding key. The idea is that you then lose access to the oracle, and thus to the private key, but you've gained enough information from your session with the oracle to make forgeries in the future. So it's not a straightforward general-purpose RSA-1024 signature break; it's pretty situational. The paper goes into detail (in section 5) about how those situations can emerge in practical scenarios.
原话 · @Anonymous
I was expecting to see mention of Microsoft/Apple executable code-signing in the examples. I know key lengths are well beyond 1024 now, but on the Microsoft side it was (is?) possible for USB tokens to be distributed in the mail. What I don't know is whether the tokens could be used as oracles in this attack.
原话 · @Anonymous
Actually it does apply to some padding schemes but old ones those based on the adding of a fixed pattern of bits.
免责声明：本卡片由 AI 从社区讨论中提炼，属于「痛点证据」，是需求分析与验证的起点，不等同于「已验证的市场需求」。AI 存在分析局限，关键决策前请打开上方原始讨论人工复核。