Windows 10: System.Security.Cryptography.CryptographicException: Bad Key after installing recent...

Hanno Bunjes hbunjes · May 30, 2024

We are getting reports of certificate operations starting to fail after the Windows Server May 2024 updates.The certificate in question has been working fine for a year.The exception has the following trace:System.Security.Cryptography.CryptographicException: Bad Key.at System.Security.Cryptography.NativeHmac.AppendDataByte[] data, Int32 offset, Int32 countat System.Security.Cryptography.HashAlgorithm.ComputeHashByte[] bufferSpecifically, uninstalling the following KBs solved the issue immediately:KB5037765KB5037933KB5038283

:)

Brink · May 30, 2024

MSR JavaScript Cryptography Library Security Vulnerability

A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cryptography (ECC) implementation.

An attacker could potentially abuse these bugs to learn information about a server’s private ECC key (a key leakage attack) or craft an invalid ECDSA signature that nevertheless passes as valid.

The security update addresses the vulnerability by fixing the bugs disclosed in the ECC implementation. In addition, an internal review resulted in other improvements to prevent rare failures in ECDH and ECDSA when using the NUMS curves.

Exploitability Assessment

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

[table][tr]Publicly Disclosed Exploited Latest Software Release Older Software Release Denial of Service [/tr] [tr][td]No[/td] [td]No[/td] [td]2 - Exploitation Less Likely[/td] [td]2 - Exploitation Less Likely[/td] [td]Not Applicable[/td] [/tr] [/table]

Affected Products

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see the Microsoft Support Lifecycle.

[table][tr]Product Platform Article Download Impact Severity Supersedence [/tr] [tr][td]Microsoft Research JavaScript Cryptography Library V1.4[/td] [td][/td] [td]Release Details[/td] [td]Security Update[/td] [td]Security Feature Bypass[/td] [td]Important[/td] [td][/td] [/tr] [/table]

Mitigations

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

Microsoft has not identified any workarounds for this vulnerability.

FAQ

The vulnerable version of the MSR Crypto JavaScript Security library is 1.4. The version with the security update is 1.4.1.
There are two possible steps required:

Install the 1.4.1 update.

If you are using the NIST P-521 curve, revoke and replace X.509 certificates issued using the NIST P-521 curve, and invalidate data signed by such certificates.

Acknowledgements

Jonathan Burns of Ionic Security Colin McRae of Ionic Security Ryan Speers of Ionic Security

See acknowledgements for more information.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

[table][tr]Version Date Description [/tr] [tr][td]1.0[/td] [td]07/10/2018[/td] [td]Information published.[/td] [/tr] [tr][td]1.1[/td] [td]07/11/2018[/td] [td]Added an FAQ regarding the availability of the update.[/td] [/tr] [tr][td]2.0[/td] [td]07/16/2018[/td] [td]Information updated to announce the release of MSR JavaScript Cryptography Library version 1.4.1.[/td] [/tr] [/table]
Click to expand...

Source: https://portal.msrc.microsoft.com/en.../CVE-2018-8319

Brink · May 30, 2024

MSR JavaScript Cryptography Library Security Vulnerability

A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cryptography (ECC) implementation.

An attacker could potentially abuse these bugs to learn information about a server’s private ECC key (a key leakage attack) or craft an invalid ECDSA signature that nevertheless passes as valid.

The security update addresses the vulnerability by fixing the bugs disclosed in the ECC implementation. In addition, an internal review resulted in other improvements to prevent rare failures in ECDH and ECDSA when using the NUMS curves.

Exploitability Assessment

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

[table][tr]Publicly Disclosed Exploited Latest Software Release Older Software Release Denial of Service [/tr] [tr][td]No[/td] [td]No[/td] [td]2 - Exploitation Less Likely[/td] [td]2 - Exploitation Less Likely[/td] [td]Not Applicable[/td] [/tr] [/table]

Affected Products

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see the Microsoft Support Lifecycle.

[table][tr]Product Platform Article Download Impact Severity Supersedence [/tr] [tr][td]Microsoft Research JavaScript Cryptography Library V1.4[/td] [td][/td] [td]Release Details[/td] [td]Security Update[/td] [td]Security Feature Bypass[/td] [td]Important[/td] [td][/td] [/tr] [/table]

Mitigations

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

Microsoft has not identified any workarounds for this vulnerability.

FAQ

The vulnerable version of the MSR Crypto JavaScript Security library is 1.4. The version with the security update is 1.4.1.
There are two possible steps required:

Install the 1.4.1 update.

If you are using the NIST P-521 curve, revoke and replace X.509 certificates issued using the NIST P-521 curve, and invalidate data signed by such certificates.

Acknowledgements

Jonathan Burns of Ionic Security Colin McRae of Ionic Security Ryan Speers of Ionic Security

See acknowledgements for more information.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

[table][tr]Version Date Description [/tr] [tr][td]1.0[/td] [td]07/10/2018[/td] [td]Information published.[/td] [/tr] [tr][td]1.1[/td] [td]07/11/2018[/td] [td]Added an FAQ regarding the availability of the update.[/td] [/tr] [tr][td]2.0[/td] [td]07/16/2018[/td] [td]Information updated to announce the release of MSR JavaScript Cryptography Library version 1.4.1.[/td] [/tr] [/table]
Click to expand...

Source: https://portal.msrc.microsoft.com/en.../CVE-2018-8319

freebeer · May 30, 2024

Best security systems for house?

A house breakout happened in our neighbourhood recently. The house break really freaks me about the security of my house. I am planning to install a good home security and alarm system at the earliest. Thing is i'm not tech savvy and don't know what kind of security systems to choose from. What kind of video surveillance and alarm system is best suited for a house of 2500 sq ft? I read in an online article that Think Protection had good reviews but im not sure about it. Which are the best ones at reasonable rates that I could use? Looking forward to your ideas and suggestions.

Windows 10: System.Security.Cryptography.CryptographicException: Bad Key after installing recent...

System.Security.Cryptography.CryptographicException: Bad Key after installing recent...

System.Security.Cryptography.CryptographicException: Bad Key after installing recent...

System.Security.Cryptography.CryptographicException: Bad Key after installing recent...

System.Security.Cryptography.CryptographicException: Bad Key after installing recent... - Similar Threads - System Security Cryptography

System.Security.Cryptography.CryptographicExceptio n: Bad Key after installing recent...

System.Security.Cryptography.CryptographicExceptio n: Bad Key after installing recent...

Issues with recent system updates or installations

Issues with recent system updates or installations

Bad system config info after installing wrong driver

Cryptography Windows 10?

How is Cryptographis Service Provider/Key Storage Provider determined?

MSR JavaScript Cryptography Library Security Vulnerability

Bad security certificate