Problems based on hash collisions, which were previously considered to be theoretical having been discovered in 2004, were now well-lodged within the domain of reality.

In my previous article, a couple of correspondents identified further issues (thanks oiaohm and Lawrence D'Oliveiro) that required further attention.  I passed their comments onto the team that developed the CA problem and can now report the responses.  In addition, additional issues raised in the article were also addressed.

As part of the article, it became apparent that the top-level Certificate Authorities still relying on MD5 for authentication had a real problem and the team had advised the 6 CAs (I‘ll not name them here, but they can be identified via some of the links provided) of the urgent need to change their hashing algorithm.  Today’s responses from one of the presentation authors show that it’s not that easy.

From oiaohm (edited for clarity): “The next thing is to work out that you missed something really bad. A fake CA can be passing through and re-approving the same key as an upstream CA to keep its invisibility and go after targeted sites. The problem here is with traffic redirection to a Fake CA.

Benne de Weger responds “The public key of the genuine website can indeed be certified by the rogue CA. But that would be pretty useless, as the attacker is not in the possession of the corresponding private key, so he can't do much with it.”

So, maybe that one isn’t such an issue.  Others are a problem.

cheapest viagra price