Dailydave mailing list archives
Re: MD5 Considered Harmful Today: Creating a rogue CA certificate
From: Charles Miller <cmiller () securityevaluators com>
Date: Tue, 30 Dec 2008 12:51:01 -0600
That's great, but it doesn't answer the question we really care about... who won the T-shirt? On Dec 30, 2008, at 10:52 AM, Alexander Sotirov wrote:
Our research team, consisting of 7 researchers from the United States, Switzerland and the Netherlands, was able to execute a practical MD5 collision attack and create a rogue Certification Authority trusted by all common web browsers. This allows us to perform transparent man-in-the-middle attacks against SSL connections and monitor or tamper with the traffic to secure websites or email servers. The infrastructure of Certification Authorities is meant to prevent exactly this type of attack. Our work shows that known weaknesses in the MD5 hash function can be exploited in realistic attack, due to the fact that even after years of warnings about the lack of security of MD5, some root CAs are still using this broken hash function. More details: http://www.phreedom.org/research/rogue-ca/ Enjoy! Alex _______________________________________________ Dailydave mailing list Dailydave () lists immunitysec com http://lists.immunitysec.com/mailman/listinfo/dailydave
_______________________________________________ Dailydave mailing list Dailydave () lists immunitysec com http://lists.immunitysec.com/mailman/listinfo/dailydave
Current thread:
- Re: tubes clogged, (continued)
- Re: tubes clogged Jess Kitchen (Dec 29)
- Re: tubes clogged H D Moore (Dec 29)
- Re: tubes clogged Petja van der Lek (Dec 29)
- Re: tubes clogged Fyodor (Dec 29)
- Re: tubes clogged Jess Kitchen (Dec 29)
- Re: tubes clogged Thorsten Holz (Dec 30)
- Re: tubes clogged dan (Dec 30)
- Re: tubes clogged Paul Melson (Dec 30)
- Re: tubes clogged Petja van der Lek (Dec 29)
- MD5 Considered Harmful Today: Creating a rogue CA certificate Alexander Sotirov (Dec 30)
- Re: MD5 Considered Harmful Today: Creating a rogue CA certificate Charles Miller (Dec 30)
- Re: MD5 Considered Harmful Today: Creating a rogue CA certificate Thomas Ptacek (Dec 30)