In 2006 two different MD5-signed certificates were created. A new stronger attack, announced last Wednesday (yes 30 Dec), allows the attacker to change more parts of the certificate, also the subject name. To use this "for fun and profit" one gets an MD5 end entity certificate from a CA (ideally one in the browser's keystore), and hacks it to create an intermediate CA which can then issue anything. Browsers generally accept this because then they trust the root and accept that the client sends an intermediate CA which the browser doesn't know about.
The IGTF's Risk Assessment Team (RAT) worked over the new year to analyse the threat and its implication for the Grid, including other attacks not proposed in the vulnerability announcement. The IGTF issued a statement about the vulnerability of the Grid. Essentially, CAs are trusted explicitly on the Grid (installed in/etc/grid-security/certificates) and the Grid is much less vulnerable than commercial PKIs (plus we have no CAs issuing MD5-signed end entity certs).
Note that while the Grid is not directly vulnerable, it is still possible to attack the Grid indirectly via the original proposal: e.g. if you fool the browser into thinking you're a trusted portal with a certificate from a commercial CA, and then you steal passwords such as MyProxy credentials.
Showing posts with label certificates. Show all posts
Showing posts with label certificates. Show all posts
Monday, 5 January 2009
Monday, 29 September 2008
New IGTF distribution 1.25
What's new? NCHC is back in (Taiwan), new keys not vulnerable to Debian incident. A number of metadata files were updated.
There is a new group, the IGTF RAT, Risk Assessment Team, which covers the whole world, timezone-wise (or close enough). The idea is when a vulnerability is announced via the IGTF, the RAT assesses the risk and alerts the CAs concerned. The idea, of course, comes from the Debian incident where "most" CAs had responded within a week but "most" is not good enough. So the RAT ran a test, alerting each CA to see how long it took to respond via the address advertised in the .info file. Of all currently accredited CAs, about 75% responded within 24 hours (including the UK!), but some took over a week and a second prodding. For many CAs it highlighted communications problems in their infrastructure as mail was being flagged as spam etc; these should be addressed in this release.
From a day-to-day operations point of view, you may be relieved to find the new FNAL certificate updated in the "experimental" folder, since the old one was due to expire soon.
https://dist.eugridpma.info/distribution/igtf/current/
There is a new group, the IGTF RAT, Risk Assessment Team, which covers the whole world, timezone-wise (or close enough). The idea is when a vulnerability is announced via the IGTF, the RAT assesses the risk and alerts the CAs concerned. The idea, of course, comes from the Debian incident where "most" CAs had responded within a week but "most" is not good enough. So the RAT ran a test, alerting each CA to see how long it took to respond via the address advertised in the .info file. Of all currently accredited CAs, about 75% responded within 24 hours (including the UK!), but some took over a week and a second prodding. For many CAs it highlighted communications problems in their infrastructure as mail was being flagged as spam etc; these should be addressed in this release.
From a day-to-day operations point of view, you may be relieved to find the new FNAL certificate updated in the "experimental" folder, since the old one was due to expire soon.
https://dist.eugridpma.info/distribution/igtf/current/
Subscribe to:
Posts (Atom)