ForgedAttributes: An Existential Forgery Vulnerability of CMS and PKCS#7 Signatures

ePrint Report: ForgedAttributes: An Existential Forgery Vulnerability of CMS and PKCS#7 Signatures

Falko Strenzke

This work describes an existential signature forgery vulnerability of the current CMS and PKCS#7 signature standards. The vulnerability results from an ambiguity of how to process the signed message in the signature verification process. Specifically, the absence or presence of the so called SignedAttributes field determines whether the signature message digest receives as input the message directly or the SignedAttributes, a DER-encoded structure which contains a …

cms current eprint report forgery message pkcs process report results signature signatures standards verification vulnerability work