SSL certificates and MD5 collisions
Posted Jan 18, 2009 1:17 UTC (Sun) by dlang (subscriber, #313)
1. a particular signer is comprimized/doing things wrong
in this case RapidSSL had done two major things wrong
A. they didn't update to not use MD5
B. they used sequential serial numbers.
2. something fundamental in the signing/encryption mechanism is broken
it can be argued that the MD5 problem really falls in this category.
with PGP/GPG you get signatures from many different people. As such the odds of all of them doing things wrong is much lower (they create their keys at different times, with different versions of software, using different options for creating their keys, eetc)
if somthing is fundamentally broken in the core mechansim it could still break everything.
Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds