Saint CurveBall, the Curve That Fooled Windows

Patron of certificates signed by anyone, home-made elliptic curves, and the NSA, which for once reported instead of keeping.

Life

On 14 January 2020, Patch Tuesday, Microsoft fixed a CryptoAPI flaw reported by none other than the NSA. Windows checked the public key of an ECC certificate but not the curve parameters: an attacker could forge certificates that looked issued by a trusted authority, and sign malware or HTTPS sites in someone else's name.

Prayer

O Saint CurveBall, who threw a curve where a straight line was expected, let our systems check every parameter and not just the convenient ones. Amen.

How to celebrate

Celebrated by installing January's Patch Tuesday and checking that code signatures really belong to who they claim.

Trust is good; checking the curve is better.