⬇ Download holy card: ·
Saint CurveBall, the Curve That Fooled Windows
Patron of certificates signed by anyone, home-made elliptic curves, and the NSA, which for once reported instead of keeping.
Life
On 14 January 2020, Patch Tuesday, Microsoft fixed a CryptoAPI flaw reported by none other than the NSA. Windows checked the public key of an ECC certificate but not the curve parameters: an attacker could forge certificates that looked issued by a trusted authority, and sign malware or HTTPS sites in someone else's name.
Prayer
O Saint CurveBall, who threw a curve where a straight line was expected, let our systems check every parameter and not just the convenient ones. Amen.
How to celebrate
Celebrated by installing January's Patch Tuesday and checking that code signatures really belong to who they claim.
Trust is good; checking the curve is better.