◄ Wiki / Crypto

Bleichenbacher forgery

A 2006 attack that forges RSA signatures when padding is parsed too loosely.

Daniel Bleichenbacher showed in 2006 that if an RSA verifier doesn't strictly check PKCS#1 signature padding, an attacker can construct a valid-looking signature without the private key, especially with small public exponents. The flaw is accepting extra or malformed bytes in the padding rather than requiring an exact structure. It is the origin of the later BERserk vulnerabilities and a lasting reminder to parse strictly.