3 ms·
Not this particular attack, as this was a test intermediate only valid for 2 weeks, but the attack was limited to an internal corporate network. For other cases
by yuhong 12y ago
Not this particular attack, as this was a test intermediate only valid for 2 weeks, but the attack was limited to an internal corporate network. For other cases it would allow browser vendor to demand audit reports for example.
- itistoday2 12y agoSo, as mentioned in the first link, client audits via the browser would do absolutely nothing during an attack: "None of CT’s proofs (audit or consistency proofs) will detect mis-issuance of a certificate by a rogue CA, not even if gossip of STHs (signed-tree-heads) successfully occurs [1]" And that's for today's attacks. In the section before that paragraph, another attack is demonstrated that also cannot be prevented by CT's audit proofs. [1] https://moderncrypto.org/mail-archive/messaging/2014/000873.html https://moderncrypto.org/mail-archive/messaging/2014/000873....
- yuhong 12y agoAnd the point is that logging intermediates only does not directly prevent the attacks but it is still useful.