4 ms·
"Q: How many certificates are affected? A: Zero. No end entity certificates are affected by this attack. The attack, when it worked, was a potential method for
by brl 18y ago
"Q: How many certificates are affected?
A: Zero. No end entity certificates are affected by this attack. The attack, when it worked, was a potential method for a criminal to create a new, false certificate from scratch. Existing certificates are not targets for this attack."
This answer seems a little bit, well, disingenuous. Does he not understand the attack or does he not understand SSL?
- catch23 18y agoI believe the answer for that question was actually pulled from the MD5 paper itself. See here: http://www.win.tue.nl/hashclash/rogue-ca/ http://www.win.tue.nl/hashclash/rogue-ca/ Scroll to the bottom in the question/answer section. It's interesting they only used 200 PS3 game consoles to do their computations with.
- brl 18y agoIn the paper itself, they reach the opposite conclusion: "Question. Suppose that a criminal creates by our method his own rogue Certification Authority that is trusted by all browsers. Are then only websites with certificates from the CA whose signature he used vulnerable to impersonation attacks? Are only websites with certificates based on MD5 vulnerable to impersonation attacks? Answer. No. When a criminal uses redirection attacks in combination with a rogue but trusted CA certificate, all websites are equally vulnerable."