3 ms·
> Which means adversaries could break the encryption, but could only afford to attack a small number of people No, because an attacker could forge a single CA
by agwa 11y ago
> Which means adversaries could break the encryption, but could only afford to attack a small number of people
No, because an attacker could forge a single CA certificate that could then be used to sign certificates for an unlimited number of websites. This is what the MD5 attack did: https://www.win.tue.nl/hashclash/rogue-ca/ https://www.win.tue.nl/hashclash/rogue-ca/
- makomk 11y agoThat attack shouldn't work these days even if you can achieve a hash collision. It requires the ability to predict the entire contents of the certificate issued by the CA and I think CAs have since moved to using unpredictable serial numbers in order to prevent this.
- agwa 11y agoAlas, random serial numbers are only a "SHOULD" in the Baseline Requirements, and not all CAs use them.