TechRepublic has an interesting article that gives a brief explanation of the MD5\/SSL exploit that was the cause of such panic last month.<\/p>\n
On the surface, this \u00e2\u20ac\u0153event\u00e2\u20ac\u009d proves that it\u00e2\u20ac\u2122s possible for an attacker to insert himself into the certificate acquisition process, resulting in wrongful authentication of visited sites. However, SSL might not be in as much danger as originally reported.<\/p>\n
Yes, there are many CAs still using MD5 for at least some certificate signing. In fact, the rogue certificate used in this exploit emulated a VeriSign RapidSSL cert. TC TrustCenter AG, RSA, and Thawte Inc. also still use the vulnerable hash function. But there are four significant mitigating factors.<\/p>\n
\n
- Most enterprise-class certificates, such as VeriSign\u00e2\u20ac\u2122s Extended Validation SSL Certificates use the still secure SHA-1 hash function.<\/li>\n
- Certificates already issued with MD5 signatures are not at risk. The exploit only affects new certificate acquisitions.<\/li>\n
- CAs are quickly moving to replace MD5 with SHA-1. For example, VeriSign was planning to phase out MD5 by the end of January 2009. The date was pushed up due to the December proof of concept. On December 31, 2008, RapidSSL certificates shipped with SHA-1 digital signatures.<\/li>\n
- The researchers did not release the under-the-hood specifics of how the exploit was executed.<\/li>\n<\/ol>\n
Again, these are mitigating factors. It isn\u00e2\u20ac\u2122t impossible for cybercriminals to come up with an attack on their own now that conceptual understanding of approach is public knowledge. But SSL is not broken. The only thing broken is a portion of the public key infrastructure (PKI) which underlies it, and the risk is manageable.<\/p>\n
(from The new MD5\/SSL exploit is NOT the end of civilization as we know it<\/a>, TechRepublic<\/a>)<\/p><\/blockquote>\n
I do not pretend to understand the mathematics behind much of this, but I find it all very interesting, nonetheless.<\/p>\n","protected":false},"excerpt":{"rendered":"
TechRepublic has an interesting article that gives a brief explanation of the MD5\/SSL exploit that was the cause of such panic last month. On the surface, this \u00e2\u20ac\u0153event\u00e2\u20ac\u009d proves that it\u00e2\u20ac\u2122s possible for an attacker to insert himself into the certificate acquisition process, resulting in wrongful authentication of visited sites. However, SSL might not be […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23],"tags":[],"class_list":["post-810","post","type-post","status-publish","format-standard","hentry","category-security"],"yoast_head":"\n
MD5\/SSL exploit not the end of the world - Blackmoor Vituperative<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.blackgate.net\/blog\/md5ssl-exploit-not-the-end-of-the-world\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"MD5\/SSL exploit not the end of the world - Blackmoor Vituperative\" \/>\n<meta property=\"og:description\" content=\"TechRepublic has an interesting article that gives a brief explanation of the MD5\/SSL exploit that was the cause of such panic last month. On the surface, this \u00e2\u20ac\u0153event\u00e2\u20ac\u009d proves that it\u00e2\u20ac\u2122s possible for an attacker to insert himself into the certificate acquisition process, resulting in wrongful authentication of visited sites. However, SSL might not be […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.blackgate.net\/blog\/md5ssl-exploit-not-the-end-of-the-world\/\" \/>\n<meta property=\"og:site_name\" content=\"Blackmoor Vituperative\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/bblackmoor\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/bblackmoor\" \/>\n<meta property=\"article:published_time\" content=\"2009-01-13T16:17:45+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2009-01-13T16:22:37+00:00\" \/>\n<meta name=\"author\" content=\"bblackmoor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/bblackmoor_\" \/>\n<meta name=\"twitter:site\" content=\"@bblackmoor_\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"bblackmoor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/md5ssl-exploit-not-the-end-of-the-world\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/md5ssl-exploit-not-the-end-of-the-world\\\/\"},\"author\":{\"name\":\"bblackmoor\",\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/#\\\/schema\\\/person\\\/bb04cdbf863652f366c64e81805d6c4f\"},\"headline\":\"MD5\\\/SSL exploit not the end of the world\",\"datePublished\":\"2009-01-13T16:17:45+00:00\",\"dateModified\":\"2009-01-13T16:22:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/md5ssl-exploit-not-the-end-of-the-world\\\/\"},\"wordCount\":307,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/#\\\/schema\\\/person\\\/bb04cdbf863652f366c64e81805d6c4f\"},\"articleSection\":[\"Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/md5ssl-exploit-not-the-end-of-the-world\\\/\",\"url\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/md5ssl-exploit-not-the-end-of-the-world\\\/\",\"name\":\"MD5\\\/SSL exploit not the end of the world - Blackmoor Vituperative\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/#website\"},\"datePublished\":\"2009-01-13T16:17:45+00:00\",\"dateModified\":\"2009-01-13T16:22:37+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/md5ssl-exploit-not-the-end-of-the-world\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/md5ssl-exploit-not-the-end-of-the-world\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/md5ssl-exploit-not-the-end-of-the-world\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"MD5\\\/SSL exploit not the end of the world\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/\",\"name\":\"Blackmoor Vituperative\",\"description\":\"But in the end it's only a passing thing, this shadow; even darkness must pass.\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/#\\\/schema\\\/person\\\/bb04cdbf863652f366c64e81805d6c4f\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/#\\\/schema\\\/person\\\/bb04cdbf863652f366c64e81805d6c4f\",\"name\":\"bblackmoor\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/bg_sigil_lg.png\",\"url\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/bg_sigil_lg.png\",\"contentUrl\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/bg_sigil_lg.png\",\"width\":900,\"height\":900,\"caption\":\"bblackmoor\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/bg_sigil_lg.png\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/bblackmoor\",\"https:\\\/\\\/www.instagram.com\\\/bsblackmoor\\\/\",\"https:\\\/\\\/x.com\\\/https:\\\/\\\/twitter.com\\\/bblackmoor_\"],\"url\":\"https:\\\/\\\/www.blackgate.net\\\/blog\\\/author\\\/bblackmoor\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"MD5\/SSL exploit not the end of the world - Blackmoor Vituperative","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.blackgate.net\/blog\/md5ssl-exploit-not-the-end-of-the-world\/","og_locale":"en_US","og_type":"article","og_title":"MD5\/SSL exploit not the end of the world - Blackmoor Vituperative","og_description":"TechRepublic has an interesting article that gives a brief explanation of the MD5\/SSL exploit that was the cause of such panic last month. On the surface, this \u00e2\u20ac\u0153event\u00e2\u20ac\u009d proves that it\u00e2\u20ac\u2122s possible for an attacker to insert himself into the certificate acquisition process, resulting in wrongful authentication of visited sites. However, SSL might not be […]","og_url":"https:\/\/www.blackgate.net\/blog\/md5ssl-exploit-not-the-end-of-the-world\/","og_site_name":"Blackmoor Vituperative","article_publisher":"https:\/\/www.facebook.com\/bblackmoor","article_author":"https:\/\/www.facebook.com\/bblackmoor","article_published_time":"2009-01-13T16:17:45+00:00","article_modified_time":"2009-01-13T16:22:37+00:00","author":"bblackmoor","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/bblackmoor_","twitter_site":"@bblackmoor_","twitter_misc":{"Written by":"bblackmoor","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.blackgate.net\/blog\/md5ssl-exploit-not-the-end-of-the-world\/#article","isPartOf":{"@id":"https:\/\/www.blackgate.net\/blog\/md5ssl-exploit-not-the-end-of-the-world\/"},"author":{"name":"bblackmoor","@id":"https:\/\/www.blackgate.net\/blog\/#\/schema\/person\/bb04cdbf863652f366c64e81805d6c4f"},"headline":"MD5\/SSL exploit not the end of the world","datePublished":"2009-01-13T16:17:45+00:00","dateModified":"2009-01-13T16:22:37+00:00","mainEntityOfPage":{"@id":"https:\/\/www.blackgate.net\/blog\/md5ssl-exploit-not-the-end-of-the-world\/"},"wordCount":307,"commentCount":0,"publisher":{"@id":"https:\/\/www.blackgate.net\/blog\/#\/schema\/person\/bb04cdbf863652f366c64e81805d6c4f"},"articleSection":["Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.blackgate.net\/blog\/md5ssl-exploit-not-the-end-of-the-world\/","url":"https:\/\/www.blackgate.net\/blog\/md5ssl-exploit-not-the-end-of-the-world\/","name":"MD5\/SSL exploit not the end of the world - Blackmoor Vituperative","isPartOf":{"@id":"https:\/\/www.blackgate.net\/blog\/#website"},"datePublished":"2009-01-13T16:17:45+00:00","dateModified":"2009-01-13T16:22:37+00:00","breadcrumb":{"@id":"https:\/\/www.blackgate.net\/blog\/md5ssl-exploit-not-the-end-of-the-world\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.blackgate.net\/blog\/md5ssl-exploit-not-the-end-of-the-world\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.blackgate.net\/blog\/md5ssl-exploit-not-the-end-of-the-world\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.blackgate.net\/blog\/"},{"@type":"ListItem","position":2,"name":"MD5\/SSL exploit not the end of the world"}]},{"@type":"WebSite","@id":"https:\/\/www.blackgate.net\/blog\/#website","url":"https:\/\/www.blackgate.net\/blog\/","name":"Blackmoor Vituperative","description":"But in the end it's only a passing thing, this shadow; even darkness must pass.","publisher":{"@id":"https:\/\/www.blackgate.net\/blog\/#\/schema\/person\/bb04cdbf863652f366c64e81805d6c4f"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.blackgate.net\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.blackgate.net\/blog\/#\/schema\/person\/bb04cdbf863652f366c64e81805d6c4f","name":"bblackmoor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.blackgate.net\/blog\/wp-content\/uploads\/2022\/06\/bg_sigil_lg.png","url":"https:\/\/www.blackgate.net\/blog\/wp-content\/uploads\/2022\/06\/bg_sigil_lg.png","contentUrl":"https:\/\/www.blackgate.net\/blog\/wp-content\/uploads\/2022\/06\/bg_sigil_lg.png","width":900,"height":900,"caption":"bblackmoor"},"logo":{"@id":"https:\/\/www.blackgate.net\/blog\/wp-content\/uploads\/2022\/06\/bg_sigil_lg.png"},"sameAs":["https:\/\/www.facebook.com\/bblackmoor","https:\/\/www.instagram.com\/bsblackmoor\/","https:\/\/x.com\/https:\/\/twitter.com\/bblackmoor_"],"url":"https:\/\/www.blackgate.net\/blog\/author\/bblackmoor\/"}]}},"_links":{"self":[{"href":"https:\/\/www.blackgate.net\/blog\/wp-json\/wp\/v2\/posts\/810","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.blackgate.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.blackgate.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.blackgate.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.blackgate.net\/blog\/wp-json\/wp\/v2\/comments?post=810"}],"version-history":[{"count":0,"href":"https:\/\/www.blackgate.net\/blog\/wp-json\/wp\/v2\/posts\/810\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.blackgate.net\/blog\/wp-json\/wp\/v2\/media?parent=810"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.blackgate.net\/blog\/wp-json\/wp\/v2\/categories?post=810"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.blackgate.net\/blog\/wp-json\/wp\/v2\/tags?post=810"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}