Verisign/RapidSSL Responds To Certificate Vulnerability

Re:Verisign/RapidSSL Responds To Certificate Vulnerability by catch23 on Tuesday December 30, 2008 @10:11PM (#415041)

I believe the answer for that question was actually pulled from the MD5 paper itself. See here:

http://www.win.tue.nl/hashclash/rogue-ca/

Scroll to the bottom in the question/answer section. It's interesting they only used 200 PS3 game consoles to do their computations with.

[ Parent | on HN ]

Re:Verisign/RapidSSL Responds To Certificate Vulnerability by brl on Tuesday December 30, 2008 @10:23PM (#415054)

In the paper itself, they reach the opposite conclusion:

"Question. Suppose that a criminal creates by our method his own rogue Certification Authority that is trusted by all browsers. Are then only websites with certificates from the CA whose signature he used vulnerable to impersonation attacks? Are only websites with certificates based on MD5 vulnerable to impersonation attacks?

Answer. No. When a criminal uses redirection attacks in combination with a rogue but trusted CA certificate, all websites are equally vulnerable."

[ Parent | on HN ]