3 ms·
Honest question: why does a SSL certificate need SHA-2? In other words, where does hashing factor into the asymmetric crypto process? So from my cursory underst
by Cyph0n 10y ago
Honest question: why does a SSL certificate need SHA-2? In other words, where does hashing factor into the asymmetric crypto process? So from my cursory understanding of SSL, it uses RSA to exchange a symmetric key which is then used for the remainder of the session.
I'm interested in crypto systems but still getting my feet wet, so a simplified answer would be really appreciated! Also, pointers to any articles or papers would be great.
- AgentME 10y agoI might be wrong, but I'm pretty sure that in practice, whenever someone signs some content, they actually sign a hash instead of the entire content so that the signature is a sane size. If you can create a hash collision between two pieces of content and then get someone to sign one of the pieces of content, then effectively you've gotten them to sign the other piece of content too without them knowing it. This happened a few years ago when SSL certificates still allowed MD5: http://www.zdnet.com/article/ssl-broken-hackers-create-rogue-ca-certificate-using-md5-collisions/ http://www.zdnet.com/article/ssl-broken-hackers-create-rogue...
- Rafert 10y agoIt's the hash of the certificate that is signed by a CA. Create a certificate with the same hash and you can transplant the signature. http://web.archive.org/web/20071226014140/http://www.cits.rub.de/MD5Collisions/ http://web.archive.org/web/20071226014140/http://www.cits.ru... demonstrates this with the MD5 hashes of two different PDF files, a letter of recommendation and a security clearance. It's common to sign hashes instead of the data, reasons are explained here: http://crypto.stackexchange.com/questions/12768/why-hash-the-message-before-signing-it-with-rsa http://crypto.stackexchange.com/questions/12768/why-hash-the...
- Cyph0n 10y agoSo basically it's used to verify a MAC? What I'm imagining: CA takes the hash of the certificate, encrypts that with its private key, and appends it to the cert. Client's browser then takes hash of locally stored certificate, and uses the CA's public key to check that the MAC attached to the incoming cert is valid. I'm guessing SSL uses RSA-PSS[1] or something similar. Guess I'll have to do some reading when I find the time. [1]: http://www.onefs.com/emc-plus/rsa-labs/historical/raising-standard-rsa-signatures-rsa-pss.htm http://www.onefs.com/emc-plus/rsa-labs/historical/raising-st...
- iancarroll 10y agoCertificates have a "tbsCertificate" component which holds almost everything (issuer, expiry, distinguished name, etc) except for the signature. The CA takes HashAlgo(tbsCertificate) and signs it with its issuing key. The relying party can then take HashAlgo(tbsCertificate) and see if the CA signed that value. Make sure you do not confuse encryption with signing. The hash is not private, so you do not need to hide its contents. I'm not sure if you can call it a MAC, because there is no key involved. It provides integrity guarantees, but the hash itself does not provide any authenticity guarantees; only the signed hash does.
- Cyph0n 10y agoAwesome. Thanks for the clear explanation!