Themes from Real World Crypto 2020
Summary: At Real World Crypto 2020, researchers presented a Bleichenbacher attack on TLS that exploits reused certificates to parallelize the attack within the 30-second session timeout, and noted the insecure PKCS#1 v1.5 padding is still supported by roughly 6% of the internet. Other talks covered a practical chosen-prefix collision on SHA-1 used to impersonate PGP, attacks recovering keys from an HSM and a TPM, and cache attacks on CTR_DRBG. The conference also covered cryptographic reviews of the Moscow and Switzerland internet voting systems, Dragonblood's finding that WPA3 is vulnerable to side-channels, and formal analysis showing 5G does not achieve untraceability.
What you should know: A man-in-the-middle downgrade attack means any server supporting the vulnerable RSA padding can be broken 100% of the time, even when the client does not support RSA key exchange, and that padding remains on about 6% of the internet. Separately, the Switzerland review found none of the zero-knowledge proofs were sound and parameters were generated incorrectly in a way that could allow votes to be modified.
Read the original at Trail of Bits Blog ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026