[tptacek]

There's a history of vulnerabilities like these, in some of the most important crypto libraries. For instance: until 2008, NSS, the TLS library used by Firefox, couldn't properly validate RSA signatures from e=3 RSA keys (it wasn't validating the full signature block, but rather parsing it and looking for the embedded hash). For e=3 roots, which were readily available at the time, you could simply build any signature block you wanted and then take its cube root.

[Herrera]

Bleichenbacher'06 never dies.

[CiPHPerCoder]

Neither does BB'98

[baby]

Can’t wait for BB20

[gonnabezuul]

Interesting. Were there any similar vulnerabilities in Windows XP's crypto libraries?

[tptacek]

There have been crypto vulnerabilities in Windows libraries before, but not the e=3 vulnerability; CryptoAPI parsed RSA signatures back-to-front, and so sidestepped the issue.