Re: libgcrypt P256 signature malleability via weak DER enforcement

Werner Koch via Gnupg-devel <[email protected]> Thu, 15 Jan 2026 15:30:44 +0100

Newsgroups	gmane.comp.encryption.gpg.devel
Message-ID	<[email protected]>

On Wed, 14 Jan 2026 17:30, Jake Ginesin said:

> understanding that non-malleability in DER parsing is important for X.509
> certificate validation [1,2] and preventing transaction malleability [3].

The first paper is on formal verifification of parsers and I don't see a
practical application here.  In particuilar because ASN.1 has in the
real world never be used as it was designed for.  It is used for data
format description and that does work okayish.  The encoding was anyway
an afterthought and there are limitations when using DER as an encoding:
For example you can only use definite lengths for signed data which in
turn forbids the use of standard tools based stream processing.

> Also, I went ahead and publicized my proof-of-concept for the first point
> in this thread's initial email. [4]

Which is the reason that DER encoded signatures are not used in this
simplified way.


Salam-Shalom,

   Werner

-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein

_______________________________________________
Gnupg-devel mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-devel

openpgp-digital-signature.asc (application/pgp-signature, 284 B)