Recently, I came across a reddit post claiming it was easy to mutate bitcoin signatures to generate message/signature pairs.
There's even POC gist
I'm just a regular software dev, and I leave the complex stuff to those that are smarter than me, but I need to know what I can be confident of.
Assuming I'm dealing with regular keys that have public blockchain transactions, and many (100's? 1000s?) available signatures of fairly similar data:
1) Is it possible to generate a new message from a signed message. For example, if I have a message "I will pay $12.50", could that be mutated to "I will pay $1250"? The posts in the link claim it is not possible to sign arbitrary data, but if that is true I don't understand how it would be possible to sign the message being discussed.
2) Are there any traits that would consistently identify a forged sig as illegitimate? The comments suggest a modulo of 0 is necessary, is it reasonable to expect any self-respecting crypto library to check for this?
3) Do I need to learn the math behind cryptography to use it effectively? There are many fields where knowing how to use something is sufficient, knowing how it works is nice but not necessary (I've been using Quaternions for a decade quite effectively without the slightest inclination to learn their actual math).
4) If (1 & 2) Is the length & complexity of a message related to ease of forging? Ie, is the message "$12.50" easier to change into "$9950" than "I promise to pay $12.50" into "You will receive from me $9950". Is there a weakness in signing many short (but unique) messages from a security standpoint? If length is longer, but entropy the same, does that change anything (ie, does adding in more characters add anything other than CPU time?)
If the answer to 3 is yes, please include an example of where not knowing the implementation details could cause critical mistakes.