Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding

Summary RSASSA-PKCS1-v15 signature verification publicKey.verify with the default scheme, also used by X.509 certificate and PKCS7 verification accepted non-canonical BER encodings of the DigestInfo, such as NULL parameters with content and non-minimal lengths. These leave attacker-controlled byt...