CVE-2015-2730: Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography (ECC) multiplications, which makes it easier for remote attackers to spoof ECDSA signatures via unspecified vectors.
The formulas appearing in ecp_jac.c do not handle the case when the addition produces infinity or adds a point to itself. An attacker can use this to generate specially-crafted signatures that cause the validation algorithm to compute the incorrect point.
Per maggiori dettagli, controlla il seguente link: link
Questo problema di crittografia a curve ellittiche potrebbe portare a false firme ECDSA o si tratta di un attacco puramente teorico?
I problemi di correttezza dell'ECC potrebbero compromettere la sicurezza in altri modi?