Security Research
CVE-2020-0601 CurveBall: ECC Elliptic Curve Spoofing in Windows CryptoAPI
Thinking
2020-01-14
5 min read
Research Dossier
#Vulnerability Analysis#Code Audit#Supply Chain Attack
CurveBall lets attackers forge a certificate that bypasses the entire Windows trust chain — all it takes is computing a pair of “isomorphic but different” elliptic curve keys, and any certificate they sign will be trusted.
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a4d4b6d4ade7253d06d61bf923572a6b8c253d117e8b63642be9ad8c68eaee7d4a02592bcdbd3155abcc6a953135deec61ed6729ad92ae056a76758bfc9dbe3a6985cd8a37681a16f72453cfe80b5e50c73a1188d3621e82b4ed37e3deafdf0c647cc517c0a8c95194040c6b5bbe41db104f9f70c90a75c3ca49e433777be632e392f7dd44689b81afe0e269f69d7135577a131632ec41a35272e40d92b6ef9e29dd1e3ea33ab3555d7d630f613b94157e1996675e133c803e4bc6e4d5632ee1b0f24b14942cc8a1d760ec6dcac5ccfeef6dbbd0caca4b0cc7b067a0537e1f863422b68659d1131cf36e0b7b5e56750573f490dddefd65f19d9e0b679d87b2532b4d9257ac8d6cc73d5a9e9f5bb7a0ad0fb342d56f721694fd7b8f0a75fbc2a2213b92cc38edd24be562e233ca76f5eb433edd338409a2a7b7cbfaf0ffa393f180a747415c13c3def34241bbafd50b89f72b6628f0d72eea63f3c5ed6a556d7fe4ac2b11ccc19a48cc371eefff9e0a017678cf9c24d7a7af2775aae65d95244258a5d69d631105e4e4e1f8324b2a73216c80c2a20b08a424dea6e91c765e762e22e38fe7e7449069f91f7286d25752816864d94a7f2f90e52c1ebd89bd6612440dba839598ad94a41e9c6fd958214ad811f7a12e6539b0fc81ecbdc84869758039359b81ae28db1ac4b209d64390eb883ad9cd5627374084d5a4db905318698b5ee92799f154da8f12994fab0486d5f7518377277ea7e1a7e02cefe4c8664975ee6e5bc47a1b25e910594e3e94954ced2c1b074d445452226412afc793758cc2532ea86979cc6f85e3aba8068d8b668c22bd44f5f6a1f95aa0ccaadf58af874e2f09578876393514cc6d77289da04a90d227ea2101b63cc5f8947c4a2c4724962d360f0a21bbd299b9417abef3b6984262281f468aa9621f18f65322c2da626715ec6cf9aded9b13dd7394d5f0e4e003ac3da70359af7e038338c74887c0d0c54d5e7d137ae44dbb9fd471d9cf8900fb94086b1f76955f4e3532a686da434a7d1c51e351496f12596751a9ccfecf08760e18cd7767d2c09346c39563768c96970fd9bea1634fed0651e3384777e67439e055bc99fcefefbe39479cb395396fbcb80b72c487cb192425d340402c8ef5b4f2686933ee21cb69c5b4aab76cc9b933654dc274263af8b0085fafce970f3e6cf9cb67141a57e7e610d7d268b7525b7e3307c51fdafd564993e8cf874c1ac7eb01242b2b52e28b9c6f32c8e5840c270540b5d7515e600c383239640708503800028328d09974259eac8418e15bac1076934526895fc1f782e6f647417bc8e2a24793897657198e221866f903cb2d272649472b34d5f40359dd33f36d3c371b4a93e3fd045a0b904a8f4013ca66ee32cf9c8adaf56171518d7dfb84d1793c4e38e5f2d60e7a50fb362db0019252963340af003a0036a6c55c2ef39e25f6c1c7a581fd915dad6c05bb3ebbccfe6f4feba914284c2a75358d87c62a758c004f95e22b0be5bcaf4ee778f63b71baf10033d525353d9335447da7412e9897397f956e7706631da9937d01d127981343b9c03d52befc59aa7ceec3f7ac36d2c5bf64561a3628c2dc69b0be8f7c497c71484adc528882072afd607757a0a2f272c5cef147dff973e7bf07f838b2e14a9618824e2bd4d8e81bc8a0b7581dcbcc7cf8f8a6a4820cbb517e88ee30b46ea9ecd7961141bd1a1cfdf83c478147fb26cb9404e91db610ba2609079b985b755f7c59664caa2b29a112f720f473dbf2356975b3ce98a2133550626eeb16466fba8b7ecaa35945e8d2faaca8d8d289d2d818d997d23202ffec24b0cf195e34c42ec1db1114f9128f4979fb1cffed79de351f5543d4f5c85bae68191f3f6b51658d8e163267b1402e575144b4c98a66607f2d2eda5797764e950ba5b7001f501aee6e86d9801dd0c9316cd9cbbed76159ef2dd8cf9598efab1050d0248985624dad9e8031f70f1267e0136e48d70ee5318b053e64d27f25a9cf8d8411968145505bb7ab8ea8ffd4759c35883209cf8c0e69cc0e68a968cced9e6b760167eb5b2b400e6513c5e0d0704c1a334a721706cc9b5c023659dcc2802d912a34463b8b1c60e08d4d2cbe28663106901a404a4397aff4ee6a0a55d8054dcf8b2320125e0e0fe7724e57c209cd11a5a809e3631b45d7dc5a8b6616a8cf9cd9ac48eca2d3f411fb0971e712356a98076d34a1595b839ae4811b319c8eb8bebbfad050f828cf9685b6de64d829e5deb6b604e8714a67d9092a83925c4f767b6cdb4ee91512afe42d7da2c8a6a24046234b8450fae76063693f0c6694bb6522b0e633e3bc388764205a7453ba57fbb665b40b993be9b6ea7ae57787f8664a667e4d83ba6368dbaffb2cc59eb30576aebb84f1220c38e811e8cf9ac90cf6acf20d9f668cdcaaa93b1d35b69015595321049faed6e08e769782729b3096c8e167f771a77712099274e59a732547d3d4c665ec56477e2a35917ff2352e17822c4c144ee1528b676e11b59fbf06f4185059af03774d7aa5ea516b933a60c766107380a1cea5c72f19d019c71cf3669a948a58b356cf24506a11bc42b8cdb00ed6b94d32859ce92b46f9b271c5c0dfda5a1651f2138e5f75c270464e282973e99cead77ae2b42d21e5e829928a435ae8d52c8a1e02caf6fb1004ca9bdca0a0e61d82633e08641668a29f33fe12836aa04348fa38c8b623c2d4cfc0f0002eb28c45548efb0f7b752c9d6f23286ca8f347263cf4be93f3c7360bd7008e911ab15af35ad56976705318b24c2ce3ab5e85b60952ec91c04de5a4db5abee01a0c737aff044be955df0ea2d41e2a0793a9b9bbadc904018b636e4dc62320e75f775e76a5e5747a0397140fb569bd8645ec54c13cd71cd59153c9677fd1785a7faf15f1e5e744cfc21a01cb354be4c0a176c1568219cb75a257669a555bd4f844a5f6f41a2960852071842d1087dd2994e87d84a5662e279da6c27d3a14fe03f9bd304edad01c1278455f0eebaeceb011451046c34c67a230845ed74568aec5a71ad880b3a670c940174b50784c5f51591ea9f69854b6dd16c584718a26f459bb4da2c47bfea194d1226b205c5af608681297a4c01f36c99828c66a8bd29e0afb62c464468bbc6b519acfcc3a30911389706246cc3f12737437f2dcc5776da6c2ea3b1e960fbb5d70272eebdf368903ba99e9dc5d1cd89a0270696e039ab5cb042b8fa76e56d34864141d9bcfc8b70520355ab9427c06c60e7f8cfafe2214d6fc05ed10a47c073104fb33b83f522a4c8aa4272e812e702620844215c0c7901cc731fc31b7ebb56e2fdb190504bc800646fe8f888927211310832bc0916a30d79328dd17355ae61f792051107a0232220af7541fdebe1c12f7f4a3cea6c1f1de5557353d3e27f3bdef57345ee127fcf8a663b7052d398a4847012d72b8f5ac90dd5ca818e6ae8323cdf0f93f952c50bfc1055f949d8d6870ee40b4c5fcce7fe0165db547c92bdc7fac3229c33e75d799f2ea69752cc372eefdf04b8a13ccd1d4326e122ee31401ae1efd46769dc23d8b766d2225fecd146c12c5e9b38703231f11b8dcc016fae29af7f1852ae152b1c0d57c67d659868c52ae8597c2e943a3f012c4a0684ad8a5dbfec59e8c6e538d7175b46df5f2cf1c3015c7a73949f4a0fb9a75602999dacdb7314f1e7ff6474f307e7ff26a8a2492ccdbc000617f30eae3393c2d3c891c576f3a4be537eee4becfbdddc6278f41fda2845c150c83b19090f651c4e1fe9af171ce238ea6c3219af13558fc25c96507f9f437d46f930d722b453231998ae861298511253645c3c02d5eb9885b03d98eca4fb324c7f4e3f72c9e69ca03decf2cbec17e150f33667217e742f4338f2e1f0be734d38b908c97b3612e8520c43f319beacf58fc1809badeb87f0ebdb85b247581117324e123537453389f79cad2d2068ac8c843db4b8dad2255b679fb51d6ebb54bb7242e730bcbc8173c7bcf85b60b9dccdba5b4bbba0b455cb2bdea01d44d93bbd2fe15fd17565cd7eb5adee04cc7d6a9767d87a3d9de43e5e985e1dccd559990dd5c39c902efb007dbaa30c70f940ee3d605120e3280b4cef75e1819d5ec9b6079cf6120b141061aa85d8d8ece9a201708547d0ac7fd97378381e64f0ac548350c985f1411cf02ece73c214b2e5258212f71bd200b5b27c11ef5134f9a6d78eea4cdbe730da181dda969d39349b82718df0ef433405bd63961a57db5477c4c9b00f1fd5fd8f30ad4512e46392b7b6e547a5ffc9bf31cccd4bfd3cce708d3938341ce8dc757082681cbab305d84cc72f57cb72d8f8a41558c499ebb3bba868b8098ebef428d04739ab75ccc0bf8cad4b713ae2731b8e5c7b71f2797bc14ba1ef3056f1e8b29e42fd8dbc293546fa3c0ca5327dbabb8e52f60d2998c1bd7ebf6cdcd2ed7e66e5bba551f96c20c4252cd5742268e28c4a5a3afb9b0eb020ac9455fee15b494db9d44182753640f967223f7fa7ff69273e20af82cb4a7addcf92cfb83c195afc4e0f24cadc4ff95927aa937218ab8e0e2a28acb76a906d2804cbdae63762d2be7a2f0550dd73f79ea9ec1c69900b25ce4e1d15ed11d5606a5674acb91f5cb5e1e0f59ac660dbe4d9ce28a7639b0d3d9bc34bdb3e34969c1ad094ed43101944cfcc728df8fae2df1c11d382138935c7e2e49af99c0078015fbc7ba866f69fc8e7b74ae398d90e607e9f130f8cb66bdbcce36cca4f2d96546af274435081941a5d0dc0ce4f1a483cd9eebd72d24d7ed33e94b765ff6870492ce2acde619933941e65e3c7e6d344f0c6b7220e7b694633ea5333ed6010c275b3386eece68ceaf05bf2e097ec2aa14b08955aa22d85c123d798e82b797b90310bffd3121ad63edbbd1a0ecd33112a5db18d773835b304b144119ae9be7e349661b2e34fdc97c521acafffe81f97fc0341389e0d4564f501076ac88138040281252983fc4381fa557955be80c70e633aaada1d7e2631da2cb1ff51e05c49b7aa65e4fa3e9af7cbc133043cb3a879ddd41858c3f46d4ebf050d00fc7383ebafa736b1b269c679636322d2c94a6662a94a3bfac5008961693f518971aed8471bf6fe12ed884cb704ebc45239ea150a67afabf84fe953a5b8aa22986e00c48d42796b78b250dcd98767a23d2dc16b1ca7a200c57265522346b6c17af9c8192e021f7f9170fb257176574df9bcb12d7ec6babc06c21e4be36a5c4aa5f1fd0fa764661b9dd97f1f1b69aa21194e5d9330506effe1231fba6457c8a62999131dc0f528444a726bc1a626ad073be77f3d9e9ddea6ecac4e55d518725eca27787f9c4b5a9e38babd8deec41c3f51780437086f01c0f7f1d49d274ea9e488f664121056c234721d17913e3f032302e286292dfc2c31c8a281f79f0911b44c746cbbb9a3de0650902a6af4e31f0e2e27f6a5291ba0c14a09b4d3d09fa90330007ff98c466763a4514737c704940a2f7d1f789306ad6084f298507aca5cff5b428576b8c6d093048abe9e8bc3ef2447c89136cfdeb5a486e01bab38d5efdf5a79e8de28f50b63c20e97065fe61d4d78a04d3a81d983e4e8e499aecfc93e174006af080a5c5165d65ffdd147c8b2d631103eaea5285a69d5ed93181b620595cb822680ad598546de325d8c065356d674bfd19c7d2422a180b99c43bdb812fe1c5078c2c230c489ebf7b5ed8d0844e7bbcbbfe393c27619ad32e8f208373b01faa7ed2f155005e6b522b4b51953ac07dd9f31e7288c1f9a18241cb25a07a33294a30c9f031f466fe2702c3087c626f044de52ca090ea85e1e9e6fd39b898705064c40448ef42357308af2be1c0ca94c942213b0980851c2b47f024763b4be26bf70dc99d5fe845bafc21bd0bc110219a3454042b6a07ed02949709f6d4f1a698cb753b46b82370f05c9572b869c1f1cc19901e4452b1c0fdc05a1cf3462feb8dcd0f760ed0900ee4ca4fddafccd67ad1b771801e23ad85717099f18bdd13aa433b73b4adc36ba303b8787ff6e8fbcd7201f08f94be42677d5e0eb4c13ca182b37402e660c9ccc022e652fcd2bbd613dc0a07200a4bb5d60dc9450bc2249ced6f9ca63bc796f0b1cda483990bfc0af7fdbff1de45d019130d562c407f8785c3871af90786e45d3f5beaa7e1253938abae3ae55bc0a99cdb8aed0b97c410866146bfee0e732a124ecf75debe5abb1df41b6d519de5160060c2f5c566c994cc8e11a16f16f2e25601d4ff2895ca1b2a184ecbca30aed7c816f09b26555ba491d9edd21b370bc76f2938269c0f364d41b12fbcccc6e6440206d09ea3c2f451a34fccc1224b8cff00bebebcd414ed5130fe5d6082de658ea6770f54d4ba63740ce3d8377b0255cb4ff46265ca6c845b10fe34057580509862a40124adbd42aa0eb76ea66177705e0beefdbbc966687d29d29daa1c8365edccb102674203a06cf12391da32ddaaf2813dc39b0bd017ab23b2d2d5fb6f9cdcce02c296474ed0c73fceff2f2ac0aae49facae58ac8d034cd96a3a461781f3e7f48e28c7c9465935a80f098eb1b15eb29513847823d9b6df8b82a07f5220d1c0a990775567ebeba7b4b4e8ae292556be0cd5aba59737e36c0f6f209e5361b88654168a8763f9689a75f8cc904b233d0e11e07817e022607729a0ba558fc1454d9718a5c4b52686d5585544a872350834d1c38c817648d5e66ca1375f26cd5ad5afa2b40f40e88fab5ce367eb9066befd3a1db135f15848cae30d7a5a8ba22f9e9b4e03442b5808eca82f9f1a061ac4226e972240915063b13ef29af80082d98337cdbfb03a839b346fbaf7c6f46cbc0d9fb948eb520f3d826f69bfeb4bc8bc7a82e691193a68a3ed9ae17dc474d58d5e51fc43a527d2957f6952ce1fae44a6177c6801dcf0227344704bb5ba94b1843443480031db6d4aa80e2edaeb9459020735db3fcd29026b8db2894af29ec26c1ad96545d00db8770d04c7e001f6b9c3fb9e3d204c2ba5ffea627333b67ebb769e426052d1186541426442dbacdbeceef61838a56957f676e17e91b3dc93283422fb166fac92867a587b2d69246c6a383a7b691ad4c166bc31ff8e5fbf9f0c1363cf732318084f767e88ec9f3aeeff756f300848aa78db78405b8145e22c4d81ea5991f07e8f721ede8b6a92469c1b1f14cdcd0e12f2331a0c78f61e78945bcc3eba5bf0aeb85e523c3314c2888ce5dab7850fd8dfd699d5cd77826d2bda1f9a302505e730a4c55cd17a8ff1dc15a825e10169c35eecc9bf11f7ac44174dd43af7297239820791e421e5982a6d44b4eedc6aa45d9db981ae167ec640ef20cac65ee439db5c57d222f3d047543931bb9488b2028c6813fc7bda2803cfc82fcc36d8d0ac1f56e4e998ead3fe3e4813ffc0d8753c2ffafc1927cb4ffafb70fab04c8e951bdb05ebdaedf145398e6f4cea90d6aa05a1cb0549c397ce3aa9158fd4b2a49f5d7e7ca11a24dfa338251fe6a3c4ddd2a11486049017182368b2fe8e976a355cce9124799e9316f05754d72201f65f7556df4685671e895abecd6efe72f934015f27850c785aa4a01ab506da908d90172407f1b6b32b63b8d32befba9fa64acf2b0338b29eaa0844585b10d824501992c1de5adfc5e83ed3d3648c5578af2df58183d2a9fcd1161eb6010a3f0cf2551cd2eb1f44b1ff4050103a1bfded51049542b323a8e28e36c38e6a86d17e2f1e6e2e70a3c72f71d0e4fdc415ccc80568643666e28f66b8f72fc234830ee6b43aa8eefec9835a6e20fd0c408217dd83bfe64f12ee6237558a583dfefa32eba48c18afe32c1dab2c2d7d6600adeaec5c775d7a6d0b2e5c0eac605de7f90689b9996d8564108a71849281e7be0efe797048c7ca8986b2e428fc6bbeedf1c10a24003768eac38539cdc3fd0af6d93a8cf3dfac15171cde18342904fcb9bfd6f0e26829dc90433bfb48ff45f6ffcf4b2e4cfb252e98319869d263de6c2788abf938c513530714de3ced8663367c8482ca08e1ab35813a4af51ffc6e918f506a1737e452a2609718cb29f9dd99de9ccc9b703821c4aaa463aacdedf326094274a1a3ea17f6169bab2981da819aa7cbf4c8e93af30a306abad683ae156c3a17826af6e3bff396932bf00a7327f851539910f29b2b4fbb3253ad8fd259f66a9cfdc4df54ce084d352d40a306acdf12c62536fbf5e913d714ffdc4f8b25ffa309d6f5d08fa9f2a9df2f1a1881d69db1a1599e3c76d53e75ddacd2eec872e923a862bef7d2fb15b66fd4dafdf72db0f4d87dcdea58b082424d6b104e80193ee7dcd323eeec3e45f0d9558147b34c0ffe66f57c217fb0b1a93fd659404b331fe8199bef414af647e2c4bbb522dd83af91bd831e910d50de6dbd14309b0cd409808f1675f181ae4ed5070f8c594901bda17d0782c5f18c65a7335327ef844666aeb62dea0be2fcf5f5ea41918a10f444df71d7f711c129110f08d75036e8696ae4870ddac9e104dab023948094d80319b8b7f6d1df66e808dc43e1fded002d1bb54d0c629b2a31ab371bb03c38ff4e5cf738a180a61ae9afaefa3e1c86ce5697053395407fdb63a02c177a5e1c81c1df0088425a0d294d28028596fabebc7304d0e4727066bef9096cd660ac07761d828c8760e773b44663b9c0d517d761ee3426b683f4be584550dfb7e87719e499e4f5596d4d7714e5034ee87408483a8bb12e7c177fb4e4f13cea304859035db9fb87397c22e86f27922ce15bde2074ec8bd991be67ed153218b990769c34341953b6f03498a9a51f76ffa299b1a827377f634cc1f6c43b6724b0bde695e4e53ac44fbf83e5b4b2ed61b240b35f2d4229acbbde814be042e999ad8b7cdb22381384ad6167779174adb85121f1ba8edd57c5f5d1e79ac1429dc3146f318362c5f57b0468237f2ad2f70f4ac1e849e95a8ea41e3c334858b991e2e310b46219cd298242fad194f754ea7d6f589e0adf3bd066ddf39924d851068e180015825b1560c6a397d18cd97ca5a0a761b56787a3b577f9b78f95a2dfbb6b1cdfbe89ed85c0aa7639b9f38719303e07395ea6b8520ea8d28fd11d2f7f696a4c04dfd999c3c91880a15dc2a71d5fff1dd2c60b17102609292bc5fb58742fac49f4f30b5b685332b284c60af9ed0cb255af10ebfd7375b28a6ca320674b430a9c4a0a441bf6d8002c127abb1cbca8bc525b4f72c57b64b3f505d75c54fdc7317f927df6a53fc4f7260ba13170c81947450012987fbdb2abaa815d916cd8de8bff7fdcf2742c63ccd511f74529e6f5036ee94daa82cd6d69cb02e71ccb89d46b7f3bac23e963f5a1f1f8af3978eb749ef8530090765eec71749a34c5cc3afbf937fb669727c2145650517572759fb9a6d3541e8ff15062f83964c0879f4b8702229444e22556e598ac5278f3db509a0edfbf2f641b5d2c46b33ccaaef55db4d7594ebc7039cae6de27ba33edd2e2784814cc52ee34db766a5859bf8db1291b9e155f05adcb0e9325cef9a83b5754076b7a7e2340d09275773592c6da0e4e318b733eb67d45ccc7f60af2ae9d597d4995db43c8b0d58c0302248e55b4b20da2e33bb0cacceeea5a2cd3ce9e3b57e65619ea7cacd27fb0745d62175ba7dcd102bb25a46a3d15abb4d0809af7b507da4d25ecadc4d91bdb7426c5b83b8c92d3a7eb530c73769a2537549da73031769c4cb44c8e916c4739d920719cf6d9687ceda7e5ae9f2f9eecfebd477e47317dcf78126a05d537f14c9e010867ec8b4e07ec8574765c5bb7726f5a5654adeb44e068738b0a2431eb6a328dde5e96f98558dbb3bc774cd2d18897cff86cd8c68c6e47f9bc8241a4fd1d3ab75a59233990f62ca04cfc716b6a75af6b21793cc776542d5505edb6d5164eb92caf464dcad56f074b2d28249978e019c2c5359a31c4262e2ea5853d004ee2230071d397f7e8c52a57f29e6f9b81f695ee614d6f43716d2936f139f1d67d48a81713bb65f1bc5626ecfdfc899e89be05af259e4b6a2cf832cdc0247b7c977052df2657226268107087c443412543a8e6b21ed0ec1bbcd44de7db4c8b5a693774af1d741044cb4bc41648374981556008169ec5a88dcd59ca57e2ede11e8003e66464cd1e129e7d4517eb1b702cf60bd81f97a7e3befe3f2fbf7ddf18e0c12e135db86df5d30ef4445df64c6e128d8ca1bdb13613159af821acfe16771edd522ecdf0c2439e931a910558677f1ac131c999f0807a03d6730fcd55ed5e9da5aa06538cab371dc5ac4bcbe4b94c49a7e4e014548e23bcb51a9c7c32593fe7660ddc3d66c4de580ac985caa99735c6f71d0ade580823fa5c4c1174cb20c9e6df52853a1ae1047a8629eaae10c390f5f5b5d8245c4e63d74ebdbd6313416ecb2348309b7cd1a1b6af04c81e9a8824c5181291a24bad930f34ad186f78037d29042aa04b92b78eccd9e37c6dd92b427f3cef436d4d9f5ee795029567988b3411f6848d1de087e0637a00e0b64d14270099c64dbd2a2715bc6fce03098f94280198e8e8b0b263b6943bdc10