EnableCertPaddingCheck

Question

Hello,
The WinVerifyTrust Signature Validation CVE-2013-3900 Mitigation (EnableCertPaddingCheck) recently started appearing on my Windows 10 machines.
I've read that the solution is to add the following to the registry
[HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config]
"EnableCertPaddingCheck"="1"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config]
"EnableCertPaddingCheck"="1"

My question is, will this create a REG_SZ string value or a DWORD value, and which one should it be?

TIA

Answer 1

What is the impact of this change? (apart from satisfying a vulernability scanner)

Answer 2

If a DWORD is required instead of instead of REG_SZ just run following as a *.bat file

@echo off

reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config" /v "EnableCertPaddingCheck" /t REG_DWORD /d 1 /f

reg add "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" /v "EnableCertPaddingCheck" /t REG_DWORD /d 1 /f

Answer 3

Microsoft has clarified the value is a REG_DWORD

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2013-3900