Episode 23: Psychic Signatures in Java!

Cryptography FM

On April 19th 2022, Neil Madden disclosed a vulnerability in many popular Java runtimes and development kits. The vulnerability, dubbed "Psychic Signatures", lies in the cryptography for ECDSA signatures and allows an attacker to bypass signature checks entirely for these signatures. How are popular cryptographic protocol implementations in Java affected? What's the state of Java cryptography as a whole? Join Neil, Nadim and Lucas as they discuss.

Music composed by Yasunori Mitsuda.

Special Guest: Neil Madden.

Sponsored By:

• Symbolic Software: Dr. Kobushi's Labyrinthine Laboratory® is a puzzle game that has been described as “a combination between Pac-Man and chess”. Guide the adventurous Ayla as she attempts to rescue her dog, Falafel, from the confines of a mysterious towering laboratory deep within a solitary forest. Dr. Kobushi's Labyrinthine Laboratory combines puzzle and strategy elements with an engaging storyline full of memorable characters and biting humor.
• IACR: AfricaCrypt is an annual International Conference on the Theory and Applications of Cryptology. AfricaCrypt is a major scientific event that seeks to advance and promote the field of cryptology on the African continent. The conference has systematically drawn some excellent contributions to the field, and has seen many renown researchers deliver keynote presentations. The conference has always been organized in cooperation with the International Association for Cryptologic Research (IACR).

Links:

• CVE-2022-21449: Psychic Signatures in Java
• CVE-2022-21449 Proof of Concept — CVE-2022-21449 Proof of Concept demonstrating its usage with a client running on a vulnerable Java version and a malicious TLS server.
• Bitwarden design flaw: Server side iterations — In the aftermath of the LastPass breach it became increasingly clear that LastPass didn’t protect their users as well as they should have. When people started looking for alternatives, two favorites emerged: 1Password and Bitwarden. But do these do a better job at protecting sensitive data?
• API Security in Action — A web API is an efficient way to communicate with an application or service. However, this convenience opens your systems to new security risks. API Security in Action gives you the skills to build strong, safe APIs you can confidently expose to the world. Inside, you’ll learn to construct secure and scalable REST APIs, deliver machine-to-machine interaction in a microservices architecture, and provide protection in resource-constrained IoT (Internet of Things) environments.
• Illuminated Security News — A low-volume newsletter covering application security, applied cryptography, and identity & access management (IAM) topics. Every newsletter covers one topic in depth with links to interesting articles and podcasts from the wider community.