Signatures that verify nothing, keys reused to death

5 min read

Two failure patterns cover a huge share of real crypto bugs.

The signature that verifies nothing. A JWT is three base64url parts — header, payload, signature — joined by dots. The header names the algorithm. The classic bug: the server reads the algorithm from the token itself and honours "alg":"none", meaning "no signature". An attacker sets the payload to whatever they want, sets alg to none, drops the signature, and the server accepts it as authentic. The lesson generalises: never let the attacker's data choose how the attacker's data is verified.

The key reused to death. A one-time pad is unbreakable — used once. Reuse the same keystream (a repeating XOR key, a repeated stream-cipher nonce, ECB's per-block determinism) and the structure leaks straight through. Repeating-key XOR falls to guessing the key length and then frequency analysis, or simply to knowing a few plaintext bytes: plaintext XOR ciphertext = key, and now you have the key for the whole message.

You have already lived the good version of this — recovering the Luraph pad without the key using bigram statistics is exactly this family of attack, done for real.