The Signature Was Valid. The Message Was Forged: A Field Guide to Serialization and Canonicalization Attacks
Why the bytes you sign matter more than the algorithm: hash length extension, ASN.1/DER forgery, JWT alg confusion, and XML signature wrapping -- and the fix.