4 ms·

As far as I can tell from the patch, the "Microsoft Enforced Licensing Intermediate PCA" certificate had code signing enabled. This is a little silly, but not

by rb12345 14y ago

As far as I can tell from the patch, the "Microsoft Enforced Licensing Intermediate PCA" certificate had code signing enabled. This is a little silly, but not an issue as long as the corresponding private key is kept safe. Unfortunately, the certificates were signed using MD5(-RSA), which is broken. I believe that what happened is that someone found a collision for this certificate and used the resulting fake certificate with known keys to sign Flame. Interestingly, one of the revoked certificates expires in 2017 and used SHA-1. This one had certificate signing enabled! It's possible that either the private key for that certificate escaped, or it's being revoked as a precaution to remove the unnecessary capabilities.

ajross 14y ago
Ah, OK. My read was that the certs granted by the Enforced Licensing thing were able to sign code. Your explanation makes a ton of sense to me. They just forgot to audit for MD5-based keys and left this alive in the wild.
tveita 14y ago
Though MD5 is considered utterly broken for cryptographic purposes, AFAIK there are as of yet no known practically viable preimage attacks. Finding a collision for an already signed certificate would require a preimage attack. There are very cheap collision attacks, which let you to generate two values that hash to the same MD5 signature; an attacker can exploit that by making you sign one object, and then swapping it out with another with the same hash.
- rb12345 14y ago
  That's true. However, it's possible to do it with two co-created certificates (http://www.schneier.com/blog/archives/2008/12/forging_ssl_cer.html http://www.schneier.com/blog/archives/2008/12/forging_ssl_ce...), and depending on how the licensing process works, that could easily have been done. I would imagine that the creators of Flame have more than enough computing power to do that. The articles though seem to be suggesting that the "real" certificates were being granted with too many powers. Microsoft's advisory seems to suggest that both were potentially used (MD5 collisions and overly-broad purposes on real certificates). It's hard to tell what really happened here...

by rb12345 14y ago

ajross 14y ago

Ah, OK. My read was that the certs granted by the Enforced Licensing thing were able to sign code. Your explanation makes a ton of sense to me. They just forgot to audit for MD5-based keys and left this alive in the wild.

tveita 14y ago

Though MD5 is considered utterly broken for cryptographic purposes, AFAIK there are as of yet no known practically viable preimage attacks. Finding a collision for an already signed certificate would require a preimage attack. There are very cheap collision attacks, which let you to generate two values that hash to the same MD5 signature; an attacker can exploit that by making you sign one object, and then swapping it out with another with the same hash.

rb12345 14y ago
That's true. However, it's possible to do it with two co-created certificates (http://www.schneier.com/blog/archives/2008/12/forging_ssl_cer.html http://www.schneier.com/blog/archives/2008/12/forging_ssl_ce...), and depending on how the licensing process works, that could easily have been done. I would imagine that the creators of Flame have more than enough computing power to do that. The articles though seem to be suggesting that the "real" certificates were being granted with too many powers. Microsoft's advisory seems to suggest that both were potentially used (MD5 collisions and overly-broad purposes on real certificates). It's hard to tell what really happened here...