Hacker News Reader

This is very nice work. For those who are interested in academic work about detecting/preventing such attacks, there have been some recent papers that looked at the formal verifying protocol models [1, 2] to (dis)prove the absence of such vulnerabilities.

1. https://eprint.iacr.org/2019/779 2. https://eprint.iacr.org/2020/823

View on HN

The article discusses interoperability issues; it isn't an attack or vulnerability.

The issue is that implementations will reject valid signatures.

Yeah, sorry, my wording wasn’t clear. I meant that attacks exist based on not utilising appropriate validation criteria (and, for example, libsodium’s more strict criteria do indeed prevent them).

Which attack(s) would that be?

Reply on news.ycombinator.com