3 ms·
Though MD5 is considered utterly broken for cryptographic purposes, AFAIK there are as of yet no known practically viable preimage attacks. Finding a collision
by tveita 14y ago
Though MD5 is considered utterly broken for cryptographic purposes, AFAIK there are as of yet no known practically viable preimage attacks. Finding a collision for an already signed certificate would require a preimage attack.
There are very cheap collision attacks, which let you to generate two values that hash to the same MD5 signature; an attacker can exploit that by making you sign one object, and then swapping it out with another with the same hash.
- rb12345 14y agoThat's true. However, it's possible to do it with two co-created certificates (http://www.schneier.com/blog/archives/2008/12/forging_ssl_cer.html http://www.schneier.com/blog/archives/2008/12/forging_ssl_ce...), and depending on how the licensing process works, that could easily have been done. I would imagine that the creators of Flame have more than enough computing power to do that. The articles though seem to be suggesting that the "real" certificates were being granted with too many powers. Microsoft's advisory seems to suggest that both were potentially used (MD5 collisions and overly-broad purposes on real certificates). It's hard to tell what really happened here...