Collected research

One Bad Apple: Backwards Compatibility Attacks on State-of-the-Art Cryptography

Tibor Jager, Kenneth G. Paterson and Juraj Somorovsky · NDSS Symposium

A standard that keeps a broken algorithm for backwards compatibility undermines the strong one when both share a key. A CBC decryption oracle is turned into a block-cipher inversion oracle that distinguishes AES-GCM ciphertexts in two queries, and Bleichenbacher's PKCS#1 v1.5 oracle decrypts RSA-OAEP and forges signatures. Shown against XML Encryption, JWE, WSS4J and Nimbus-JWT.

Record

Researcher

Tibor Jager, Kenneth G. Paterson and Juraj Somorovsky

Published by

NDSS Symposium

Topic

Crypto

In the archive

• Collected in the 2013 research round

Tags

• jwt
• saml
• soap
• java
• sso
• mitigation
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Tibor Jager, Kenneth G. Paterson and Juraj Somorovsky, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.