Dailydave: Re: MD5 Considered Harmful Today: Creating a rogue CA certificate

[Charles Miller <cmiller () securityevaluators com>]

That's great, but it doesn't answer the question we really care  
about... who won the T-shirt?

On Dec 30, 2008, at 10:52 AM, Alexander Sotirov wrote:

> Our research team, consisting of 7 researchers from the United States,
> Switzerland and the Netherlands, was able to execute a practical MD5  
> collision
> attack and create a rogue Certification Authority trusted by all  
> common web
> browsers. This allows us to perform transparent man-in-the-middle  
> attacks
> against SSL connections and monitor or tamper with the traffic to  
> secure
> websites or email servers.
>
> The infrastructure of Certification Authorities is meant to prevent  
> exactly
> this type of attack. Our work shows that known weaknesses in the MD5  
> hash
> function can be exploited in realistic attack, due to the fact that  
> even after
> years of warnings about the lack of security of MD5, some root CAs  
> are still
> using this broken hash function.
>
> More details:
> http://www.phreedom.org/research/rogue-ca/
>
> Enjoy!
>
> Alex
> _______________________________________________
> Dailydave mailing list
> Dailydave () lists immunitysec com
> http://lists.immunitysec.com/mailman/listinfo/dailydave
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave