CAPEC Definitions

    CAPEC Definitions / CAPEC-485

    CAPEC-485: Signature Spoofing by Key Recreation

    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

    Severity:High
    Possibility:Low

    Extended Description

    No Extended Description.

    Mitigations

    Ensure cryptographic elements have been sufficiently tested for weaknesses.

    Relationships with other CAPECs

    CAPEC-473: Signature Spoof

    Prerequisites

    An authoritative signer is using a weak method of random number generation or weak signing software that causes key leakage or permits key inference.

    An authoritative signer is using a signature algorithm with a direct weakness or with poorly chosen parameters that enable the key to be recovered using signatures from that signer.

    Related Weaknesses

    CWE-330: Use of Insufficiently Random Values