Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering the Verification QR Code on My Diploma

obrhubr.org

Post reply on HN
Print view View original

1–10 of 26 posts

Re: Reverse Engineering the Verification QR Code on My Diploma

#2

Post by pxx »

this analysis does not seem particularly good and seems to be written for maximum hype value instead of correctness.

e.g.:

> The first issue is the absolute disregard for any of the standards related to RSA key usage. Encrypting with the private key and decrypting with the public key is usually only done in the context of signing/verifying.

but... you are doing a verification at this stage. this is how public-key encryption works. but since the data is so short, the "signature" is just the data itself instead of a (essentially) a hash of it.

the stuff about pkcs#1 1.5 likewise is irrelevant. there's no way to get a padding oracle, and the Bleichenbacher '06 signature forgery scheme seems to be an attack on a bad signature verification algorithm and not an issue with the primitive. but we're not using signature verification here.

Re: Reverse Engineering the Verification QR Code on My Diploma

#3

Post by obrhubr »

pxx wrote: post #2

this analysis does not seem particularly good and seems to be written for maximum hype value instead of correctness. e.g.: > The first issue is the absolute disregard for any of the standards related to RSA key usage. Encrypting with the private key and decrypting with the public key is usually only done in the context of signing/verifying. but... you are doing a verification at this stage. this is how public-key enc…

Thanks for the feedback, appreciate it. I wanted this to more entertaining than informative, but I understand why this might mislead.

- I agree that the section on pkcs#1 is at this point irrelevant, I left it in just to mention that fact. But I will probably take it out now :)

- Concerning the part of misusing RSA: My understanding is that you usually append the signature at the end, after a copy of the data which is not done here. I believe they are misusing it here because no library for RSA supports this use case, to decrypt using a public key you always have to provide the message and signature. This isn't possible here because the message is encrypted. So I think they are misusing RSA.

Re: Reverse Engineering the Verification QR Code on My Diploma

#6

Post by zoover2020 »

obrhubr wrote: post #3
pxx wrote: post #2

this analysis does not seem particularly good and seems to be written for maximum hype value instead of correctness. e.g.: > The first issue is the absolute disregard for any of the standards related to RSA key usage. Encrypting with the private key and decrypting with the public key is usually only done in the context of signing/verifying. but... you are doing a verification at this stage. this is how public-key enc…

Thanks for the feedback, appreciate it. I wanted this to more entertaining than informative, but I understand why this might mislead. - I agree that the section on pkcs#1 is at this point irrelevant, I left it in just to mention that fact. But I will probably take it out now :) - Concerning the part of misusing RSA: My understanding is that you usually append the signature at the end, after a copy of the data which i…

Agree on the crypto stuff, it's easy to get things wrong or share wrong information. Perhaps you can peer review in the future to avoid.

Nonetheless, please keep writing! It was an entertaining read for me.

Salutations du Luxembourg :-)

Re: Reverse Engineering the Verification QR Code on My Diploma

#7

Post by obrhubr »

zoover2020 wrote: post #6
obrhubr wrote: post #3

Earlier quoted context omitted.

Thanks for the feedback, appreciate it. I wanted this to more entertaining than informative, but I understand why this might mislead. - I agree that the section on pkcs#1 is at this point irrelevant, I left it in just to mention that fact. But I will probably take it out now :) - Concerning the part of misusing RSA: My understanding is that you usually append the signature at the end, after a copy of the data which i…

Agree on the crypto stuff, it's easy to get things wrong or share wrong information. Perhaps you can peer review in the future to avoid. Nonetheless, please keep writing! It was an entertaining read for me. Salutations du Luxembourg :-)

Thank you very much! Salut d'Autriche :)

Re: Reverse Engineering the Verification QR Code on My Diploma

#8

Post by gwervc »

There's already a government website to check some diploma (like brevet, bac, etc.), this app and some universities have deployed a blockchain-based system to grant and verify degrees. I wish less public money were spent on N different technological solutions that overlaps with each other's yet not of the them is really finished or complete.
Post reply on HN