Messages in this thread | | | From | Andy Lutomirski <> | Date | Mon, 1 Jun 2015 10:06:49 -0700 | Subject | Re: [PATCH 16/20] PKCS#7: Add an optional authenticated attribute to hold firmware name [ver #5] |
| |
On Mon, Jun 1, 2015 at 8:50 AM, David Howells <dhowells@redhat.com> wrote: > Andy Lutomirski <luto@amacapital.net> wrote: > >> > You can also fudge the signature (or a hash) by adding extra data to or >> > modifying the data blob and by switching signature values between signature >> > blobs. >> >> So there's another design error in PKCS#7? Great! > > No. This applies to *all* signatures where you're signing a hash.
What kind of fudging are you talking about here? I don't see what not-intentionally-signed message can be generically fudged to look like it's signed.
--Andy
| |