Turing Forbidden Zone

When I didn't go to class, I sat in the library today and borrowed the Internet here.

When Chu Yingzong came to recruit people after class, he saw this student from Bingshan Elementary School sitting in the far corner of a multi-functional media room, looking at his laptop thoughtfully, frowning vaguely. wrinkle marks.

——Is the problem really difficult to solve?

Chu Ying walked in and closed the door, looked at Shiye for a while, unknowingly peeled all the oranges she brought, and quietly put them in Shiye's hand.

Shi Ye looked up at Chu Yingzong.

Chu Yingzong: "I'm super quiet! I didn't disturb you!"

"..." Shi Ye silently lowered his head again.

After a while, Chu Yingzong peeked at the content on Shiye's screen, and saw that he seemed to be looking at a dll file this time, and the name of the function was probably: CertDllVerifyMicrosoftRootCertificateChainPolicy...

Chu Yingzong couldn't help asking curiously: "Aren't you going to hack the phone? Why are you looking at digital certificates?"

Shi Ye said: "ECC has been updated to a new version, and the compatibility with IOS is not very good, and there may be loopholes."

After hearing this, Chu Ying lifted her spirits, "It makes sense!"

He then glanced at the screen and glanced at the newly updated functions inside.

According to the comparison after the version update, Microsoft mainly modified several functions related to the certificate chaining strategy this time, and added several compatibility entries for the new protocol.

I debugged thoughtfully back and forth day and night, and highlighted some codes about memory comparison.

Chu Yingzong could still understand this, and asked curiously, "Is this the public key comparison?"

Shi Ye said, "Yes."

Digital certificates, which can be compared to human "visas", need to be issued by officially trusted institutions.

Take the elliptic curve algorithm (ECC) invented by Microsoft as an example: the visa agency first selects a private key, defines an elliptic curve with the private key, and introduces additional parameters to obtain another solution on the ellipse, which is the public key.

The private key is only known to the visa agency itself, but the public key is to be released to the entire Internet.

When a visa agency issues a digital certificate to a software, he will use his own private key, some local parameters and a hash value to generate a signature, which becomes the "visa" of that software.

Then, anyone on the public network can use the public key to compare the visa of this software, that is, through the elliptic curve calculation again, you can compare whether the results are equal——

Equal means that the "visa" is issued by an official agency, no problem;

If they are not equal, then this is an "invalid visa", this software is suspicious, and it is a black household without a passport, so it should not be trusted.

The entire digital visa process is an asymmetric encryption strategy.

The "asymmetry" lies in: the visa agency holds the private key, while everyone holds the public key. The whole process can only be checked, but cannot be reversed.

Just like the country has mastered the anti-counterfeiting technology of printing money, everyone can simply check and touch the anti-counterfeiting marks of coins, but no one can forge such marks.

This technology can also help computer software to prevent counterfeiting to the greatest extent, and it also guarantees the security of the device itself in disguise.

However, in the world of Time and Night, nothing is impossible.

After all - "There is no absolutely secure system in the world, only loopholes that have not yet been discovered".

He tried the updated ECC visa algorithm back and forth, and then found a function called "CertVerifyCertificateChainPolicy", which passed four certificate-related parameters consecutively, and passed them to the downstream function without any processing.

He was lost in thought.

Seeing that Shi Ye suddenly stopped at a certain position, Chu Ying couldn't help staring at it for a while, then scratched her head and asked, "Shi Xiaoye, I can understand the OID parameter, what do the remaining three mean?"

Shi Ye picked up a pen, wrote down these parameters on a piece of paper, and explained to him: "Assuming that the private key of the root certificate is p, we have no way of knowing this private key, but the base point of ECC is G, then the public key It is pG. These few parameters are just customizing the parameters r, s and public key of the elliptic curve..."

Having said that, his voice suddenly stopped.

Chu Yingzong let out a sharp "Ah" and said, "Then if I verify it like this, I can pass in the parameters myself and use exactly the same custom parameters, so I can use any private key to get a visa?"

After a moment of silence, Shi Ye said, "You think well."

Shi Ye opened the command prompt on the computer, started using the openssl command, forged a series of parameters, and tried to generate a new ECC certificate.

Then, with the forged ECC certificate, he casually signed a three-no small software.

Chu Yingzong took out his mobile phone and connected it to the computer on his own initiative when he saw half of it.

Then, Shi Ye tried to install the software on his phone——

The digital signature verification is passed.

The software installation was successful.

At this point, Chu Yingzong's mouth had turned into an "O" shape, and she shouted, "Wow, wow, wow, wow, we found a 0day! Shi Xiaoye, post it!"

Shi Ye calmly said, "Yes."

He continued to do the next work, checked this forged digital certificate, the name was just a random "1", the signer's name and date were not there, but it was trusted in the system" normal certificate".

Chu Yingzong was not so calm anymore, she smirked and turned around twice, stuffed two pieces of orange into Shi Ye's mouth, and said happily: "This is a loophole in the digital certificate, at least it is a 'critical' level to submit to Microsoft. .When the bonus is paid out, Shi Xiaoye, you will become a millionaire!"

The orange was very sweet, so Shiye ate it silently and licked his lower lip.

Chu Yingzong's heart fluttered when he saw it, and he kissed him happily again.

The senior was also very sweet, Shi Ye was kissed silently, and then said casually: "Don't submit it yet."

Only then did Chu Yingzong remember: "Ah yes, this is the first step. Are you really going to crack IOS system 13?"

Shi Ye: "Yeah."

While talking, Shi Ye kept on moving and packed the certificate into his IOS cracking package.

Got a priceless Microsoft 0day, which didn't seem to have any effect on him.

Perhaps what he is more happy about is that he can go a step further in solving the problem.

Chu Ying calmed down unconsciously, looked at his focused profile, and thought about things blankly for a while.

After a while, Chu Yingzong said: "Aye, have you ever considered that after you actually crack the system, you may have a great reputation, which you may not like..."

Shi Ye paused.

He really didn't think about it - many things in the real world were instinctively out of his consciousness.

At this time, Chu Yingzong said: "Didn't it seem that a high school student in Europe cracked it in the fourth generation of IOS? He became famous that night and was sued by Apple. Although the final judgment of the court was 'intellectual curiosity' , not convicted..."

"I know." Shi Ye said, "This is a gray area of ​​the law."

Chu Ying lowered her head and said, "Shi Xiaoye, we can try it for academic purposes, but can you promise me that you won't use it for illegal profit?"

Shi Ye looked at him for a while, with a faint smile on the corner of his mouth, and said, "Okay."

Only then did Chu Yingzong become active again, and said cheerfully, "Okay! Is there anything else I can do to help? I'll come too! I'll come too! The Sa family has never done such a big thing in their life—exciting!!"

Throughout the whole day, Chu Yingzong couldn't help spending time in the library with Shi Ye.

Together they looked at those gawky functions, debugged all kinds of messy parameters together, and were tortured by esoteric mathematical problems to doubt their lives.

Whenever the brain cells die, Chu Yingzong silently peels an orange and feeds it to Shi Ye, who eats it unconsciously... As a result, he can't eat dinner at all.

Chu Ying went outside and brought back two big bowls of wontons, and started feeding Shi Ye one and the other, as if he would be hungry if he didn't eat dinner.

In the end, the two had to collapse together on the sofa.

Chu Yingzong's mind was empty and tired.

Hours and nights last.

At night, Yu Jingshu really started working overtime again.

He used the internal software to send a message to Shi Ye: [Mr. Consultant, do you have any new progress today?We have prepared some additional documents here, you can take a look. 】

Shi Ye: [Yes. 】

Yu Jingshu was very surprised: [Can you explain to me? !I'll call right away. 】

Shi Ye: [Not convenient, Chu Ying fell asleep. 】

Yu Jingshu: [Are you in the dormitory?You can go out and answer the phone without disturbing him. 】

Shi Ye: [No, I looked at him. 】

Yu Jingshu: "??" What does this mean, why do you watch him sleep?Too succinct.Whenever I talk to this kid, I always feel like I'm going to go bald again.

In fact, Shi Ye was only entangled by Chu Yingzong.

The silly senior was lying on the sofa, his mouth was still opening and closing in his sleep, like a stranded mermaid.

Shi Ye stretched out his hand, pulled out the data cable under him, and charged the phone that had been used for a day.

Chu Yingzong snorted dissatisfiedly in a daze, reached out and grabbed Shi Ye's waist, rubbed his face on his back twice, and then snored again.

Time and night: "..."

Shi Ye stretched out his fingers and plucked Chu Ying's trembling eyelashes, in exchange for two piggy-like grunts.

Shi Ye tilted his head, and stretched out his hand to stroke his nose bridge, brow tip, slightly parted lips one by one, and many other things he was interested in.

Hurt by the quarrel, Chu Ying turned impatiently and fell asleep, her mouth pouting unconsciously.

But Shiye seemed to have found a new toy, and felt a sense of pleasure, completely forgetting about his running computer.

Chu Yingzong slept for a while, always feeling itchy all over her body, and finally got up with a scrambled hair, "Forget it, let's go back to the dormitory to sleep?"

Shi Ye looked at him deeply and said, "Yes."

Chu Yingzong's face was flushed from sleep, she got up and packed her things in a daze, threw all the orange peels into the trash can, and said casually: "Solving the problem, don't be in a hurry, I will come to you tomorrow after class is over... "

"But I like 'this question' very much, and I hope to start working as soon as possible tomorrow." Shi Ye said suddenly, after thinking about it, he added, "I hope I can do it at night."

Chu Ying was stunned for a long time: "Damn, is this the realm of learning gods? It's incomparable."

Shi Ye paused for a moment and said, "...Maybe it's because the topic is relatively novel and interesting."

Chu Yingzong complained: "Doing questions every day, don't you know how to combine work and rest? Can you leave a place in your schedule to play with me... Hey, what are you laughing at?"

Shiye laughed without saying a word.

The author has something to say: don't think too much, this vulnerability has been fixed by Microsoft in January 2020.