Information Leakage in NSS Affecting RSA Key Exchange and Signature Forgery

CVE-2023-4421

What is CVE-2023-4421?

The NSS software contained a vulnerability that allowed attackers to exploit timing side-channels while checking PKCS#1 v1.5 padding. By leveraging this flaw, an attacker could potentially decrypt intercepted RSA-encrypted messages or forge signatures using the victim's key. The vulnerability arises from leaking information through timing differences related to padding validation and encrypted message lengths. The issue has been addressed by the implementation of the implicit rejection algorithm, which ensures NSS responds with a deterministic random message when invalid padding is detected.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References