|
Brought to you by:
Suppliers of:
|
|
|
| |
| LibTomCrypt is "a fairly comprehensive, modular and portable cryptographic toolkit that provides developers with a vast array of well known published block ciphers, one-way hash functions, chaining modes, pseudo-random number generators, public key cryptography and a plethora of other routines". A vulnerability was found in LibTomCrypt by the author within the signature scheme used with the Elliptic Curve Cryptosystem routines that will allow arbitrary signatures to be created by an attacker. |
| |
Credit:
The information has been provided by SSC Advisory Notice.
|
| |
Vulnerable Systems:
* LibTomCrypt version 1.02 and prior (that apply ECC with signatures)
Immune Systems:
* LibTomCrypt version 1.03 (that apply ECC with signatures)
During recent cryptographic review by the author, a mathematical flaw was found within the implementation of the El Gamal signature algorithm used in LibTomCrypt versions 1.02 and prior. An attacker can create a valid random signature by selecting a random value for a, and then computing (a^-1)C (where the inverse is modulo the order of the curve), essentially allowing an attacker to sign arbitrary messages without the private key.
|
|
|
|
|
