News for hackers. Stuff that matters.

A comment on An Overview of Cryptography. Parent comment

Re:An Overview of Cryptography by arkadiyt on Friday November 29, 2019 @12:38PM (#21665710)
LetsEncrypt was vulnerable to this exact attack - it let people issue valid TLS certificates for domains they didn't control:

https://www.agwa.name/blog/post/duplicate_signature_key_sele...

[ Parent | on HN ]
Re:An Overview of Cryptography by galadran on Friday November 29, 2019 @12:52PM (#21665771)
We discuss this exact attack (and blog post) in Section 5.1 of the paper :).

IIRC: it was missed by both an academic analysis of LE and a 3rd party audit of their crypto design. Thankfully Andrew spotted it a few weeks before they went live in major browsers!

[ Parent | on HN ]