Examining CVE-2020-0601 Crypt32.dll Elliptic Curve Cryptography (ECC) Certificate Validation Vulnerability

Since its inception, asymmetric cryptography use cases include public key encryption, the construction of a secure channel to share a session key, and the act of digital signing. X.509 is the most prevalent standard for public key certificates in internet protocols. While compatible with a diverse set of algorithms and parameters, the use of Elliptic Curve Cryptography (ECC) for public keys has become a modern standard due to its security utility. As with any capability targeted for abuse by motivated and capable threat actors, the use of ECC public keys in X.509 certificates have dependencies that are often a valuable target. One such software dependency is the mechanism for trusted certificate validation. In Windows operating system environments, the CryptoAPI often performs this function. This paper will explore the critical vulnerability CVE-2020-0601 in crypt32.dll that enables an attacker to forge trusted ECC-based X.509 public key certificates without knowing a valid private key. In addition to a technical exploration of this certificate verification vulnerability, this paper proposes several detection methodologies and practical detection with Yara rules.