The First Few Milliseconds of an HTTPS Connection
This is a fine article. Unfortunately, it describes very specifically how <i>not</i> to verify an PKCS RSA signature, perpetuating a mistake that screwed over browser vendors a couple years back:<p><a href="http://www.matasano.com/log/558/public-key-signature-forgery-collected/" rel="nofollow">http://www.matasano.com/log/558/public-key-signature-forgery...</a><p>To wit: you verify specifically cannot look at the SHA-1 hash at the end of an RSA block and compare it to your own hash, because there are hundreds of zillions of other RSA blocks that can result from the RSA algorithm that could contain a SHA-1 block of an attacker's choosing.<p>Vendors learned the hard way that to verify an RSA signature, you have to reconstruct the entire m block you'd expect to see, and byte compare it to the entire "decrypted" m block from the certificate.<p>Crypto sucks.