Given an RSA signature as produced by
openssl dgst -sha256 -sign rsapriv.pem -out afile.sig afile
and without access to the private key used for that, one can¹ come up with a fully functional RSA public/private key pair such that signature
afile.sig verifies against that new public key and any desired file.
This does not break the basic security promise of signature, which is that given a public key, it's impossible to come up with a signature and a file that matches the public key, unless the holder of the matching private key is involved and is willing that.
Nevertheless, that could enable signature misappropriation attacks with some level of social engineering.
afile are hosted on a trusted website, in order to authenticate
afile. Malory makes a key pair matching
afile, perhaps gets it certified, then has something to pass as evidence for affiliation with
afile or/and the trusted website, on the tune of: "the website entrusts me for matters related to
afile, since it host my signature for that. Yes I made that signature, check it yourself against my certificate!".
In a variant,
afile is on a website under control of Malory, who makes whatever
bfile, then a key pair matching
bfile, and tries to pass
bfile as the real thing since it checks against a (rightly) trusted signature.
Which deployed signature formats are resistant (or not) to such signature misappropriation?
Mildly formal definition: a signature scheme is misappropriation resistant if, given one of its public key
M, and legitimately computed signature
S (thus passing verification), it is computationally infeasible to exhibit a public key
Pub' and a message
M' such that
Spass signature verification.
- When later given a random message
M", the attacker exhibits with sizable probability
S"pass signature verification.
M'≠M) would be misappropriation without (resp. with) alteration (of the message).
Pub'≠Pub is implied by condition 2 and the usual security property of a signature scheme. We define weakly misappropriation resistant by replacing 2 with
If the public key, or a second premimage resistant hash thereof, is part of the signature, or is hashed with the signed data (as in EdDSA), then the scheme is misappropriation-resistant.
In OpenPGP, it seems the signature embeds the key id, which is the low-order 64 bits of the hash of the oublic key. We'd need to generate 264 suitable public keys and hash them to carry the attack. That's not unimaginable, but a lot of work.
And then there are all the other formats that I do not even know about.
¹ That's a matter of seconds for standard modulus size. The resulting key is fully PKCS#1 conforming, and can even be made secure. Disclosing details on how would risk to ruin an ongoing CTF asking for similar math, but trust me, it works.