44 ms·
Well, SSL is based off of the concept of a web of trust, which means that if you obtain a root SSL cert (like those held by Verisign, etc) you can perform man-i
by kylec 17y ago
Well, SSL is based off of the concept of a web of trust, which means that if you obtain a root SSL cert (like those held by Verisign, etc) you can perform man-in-the-middle attacks on countless sites. So while the requirements for successfully mounting the attack are very high, so are the potential rewards.
- tptacek 17y agoSSL is based on trust anchors (PKI), not web of trust (web of trust is PGP).
- wendroid 17y ago"on the" not "off of the"
- rlpb 17y agoI assume that you're talking about obtaining a root SSL cert private key. In order to do this using this exploit, you'd need physical access to a machine that has that private key stored on it already (presumably a few very high security servers at Verisign, etc). I'm pretty sure that you'd find it easier to compromise such a server remotely using some other attack not discussed here. I'm also sure that companies holding such a key take their security very seriously. In short, I don't think that this side-channel attack is even close to being applied to anything but a DRM system; certainly not to a root SSL cert.