Re:Creating a rogue CA certificate with MD5 hash collisions
by timf on Tuesday December 30, 2008 @12:44PM
(#414421)
OK, if you're right about the serial number part that is great. All I did was export the CA certs in my Firefox install and then ran a quick program on all the files to extract the signature algorithm.
Re:Creating a rogue CA certificate with MD5 hash collisions
by tptacek on Tuesday December 30, 2008 @12:51PM
(#414434)
Then nothing in that list is relevant, either.
Anyhow, the program you want to check this out is Firefox itself: Preferences -> Advanced -> Encryption -> View Certificates -> Authorities -> "View" -> Details.
Re:Creating a rogue CA certificate with MD5 hash collisions
by timf on Tuesday December 30, 2008 @12:57PM
(#414451)
There were too many to check out manually that way, so I exported as pem and extracted sigalg.
I removed the list from that link, anyhow. I didn't understand the 'sign predictably' part you pointed out, much appreciated.
The reality seems to be that only RapidSSL and FreeSSL are practically vulnerable; of the small subset of CAs that will sign with MD5, they're the two that will sign predictably; the others randomize the serial number field.
Moreover, this is an exceedingly hard vulnerability to exploit. Sotirov's team not only had a cluster of PS3s running custom code optimized to quickly find MD5 collisions, but were also working with a new academic result on collision-finding that has not yet been published.