3 ms·

How the 2011 hack of DigiNotar changed the Internet’s infrastructure

94 points by nayuki 10y ago

stephengillie 10y ago
On one side, the CA certificate network forces a different kind of trust than SSH certificates. With a CA cert, you trust the browser company, and (sometimes) distrust the host. With SSH, the choice is only whether or not you trust the host. (Please note Windows uses a similar cert for RDP, with the same options to trust once, trust forever, or disconnect immediately.) Certificate Transparency is almost a type of blockchain, where what's stored is a website's decryption key.
- praseodym 10y ago
  In Windows, one can use a certificate signed by the internal enterprise CA for RDP. This means that if one trusts the enterprise CA (which is the case within an enterprise), all internal RDP connections are immediately verified without prompts.
- deleted 10y ago
  [deleted]
- Edmond 10y ago
  Minor nitpick/correction: certificates are public keys, not decryption keys. Also you can only encrypt with a public key and decrypt with a private key or sign with a private key and verify with a public key. In general the CA PKI is mainly for endpoint (mainly server) authentication, actual encryption typically uses symmetric keys.
- 0x0 10y ago
  To nitpick, OpenSSH does offer a CA-based approach as well. Perhaps not as commonly used as regular host and client keys, though.
thesimp 10y ago
There was so much more to this hack then what is described in this article. Google for Foxit, Diginotar and Black Tulip for the complete report. It is interesting to read how the intruders navigated the separate networks and got full RDP access to the 8 CA generator servers in the secure room.
- nickpsecurity 10y ago
  Which one covers the last detail the best?
- WestCoastJustin 10y ago
  For anyone else, this seems to be the report referenced: https://www.rijksoverheid.nl/binaries/rijksoverheid/documenten/rapporten/2012/08/13/black-tulip-update/black-tulip-update.pdf https://www.rijksoverheid.nl/binaries/rijksoverheid/document...
alexdgg 10y ago
the real Mr. robot

94 points by nayuki 10y ago

On one side, the CA certificate network forces a different kind of trust than SSH certificates. With a CA cert, you trust the browser company, and (sometimes) distrust the host. With SSH, the choice is only whether or not you trust the host. (Please note Windows uses a similar cert for RDP, with the same options to trust once, trust forever, or disconnect immediately.) Certificate Transparency is almost a type of blockchain, where what's stored is a website's decryption key.

praseodym 10y ago
In Windows, one can use a certificate signed by the internal enterprise CA for RDP. This means that if one trusts the enterprise CA (which is the case within an enterprise), all internal RDP connections are immediately verified without prompts.
deleted 10y ago
[deleted]
Edmond 10y ago
Minor nitpick/correction: certificates are public keys, not decryption keys. Also you can only encrypt with a public key and decrypt with a private key or sign with a private key and verify with a public key. In general the CA PKI is mainly for endpoint (mainly server) authentication, actual encryption typically uses symmetric keys.
0x0 10y ago
To nitpick, OpenSSH does offer a CA-based approach as well. Perhaps not as commonly used as regular host and client keys, though.

thesimp 10y ago

There was so much more to this hack then what is described in this article. Google for Foxit, Diginotar and Black Tulip for the complete report. It is interesting to read how the intruders navigated the separate networks and got full RDP access to the 8 CA generator servers in the secure room.

nickpsecurity 10y ago
Which one covers the last detail the best?
WestCoastJustin 10y ago
For anyone else, this seems to be the report referenced: https://www.rijksoverheid.nl/binaries/rijksoverheid/documenten/rapporten/2012/08/13/black-tulip-update/black-tulip-update.pdf https://www.rijksoverheid.nl/binaries/rijksoverheid/document...

alexdgg 10y ago

the real Mr. robot