CAPEC-475: Signature Spoofing by Improper Validation
Description
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.
- Likelihood of attack
- Low
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- Recipient is using a weak cryptographic signature verification algorithm or a weak implementation of a cryptographic signature verification algorithm, or the configuration of the recipient's application accepts the use of keys generated using cryptographically weak signature verification algorithms.
Skills required
- HighCryptanalysis of signature verification algorithm
- HighReverse engineering and cryptanalysis of signature verification algorithm implementation
Mitigations
- Use programs and products that contain cryptographic elements that have been thoroughly tested for flaws in the signature verification routines.