Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.programming > #4617

Re: On Risks and Vulnerabilities of Digital Signatures

Show all headers | View raw

Mok-Kong Shen wrote:

> (2) Also open-source software can contain grave errors, which due to
> lack of persons in the public having interest, time and appropriate
> knowledge to thoroughly examine them could remain undetected for a long
> time. Example: the Heartbleed Bug of OpenSSL.
> (https://www.schneier.com/crypto-gram-1404.html).

Not just bugs in the security code, but also missaplication of working (or at 
least not known-to-be-broken) code.

For instance these researches created /genuine/ a CA (in the sense that any 
working software would accept certs it signed) by exploiting weaknesses in the 
way upstream CAs worked.
    http://www.win.tue.nl/hashclash/rogue-ca/
(Which you probably know about already, but it's an interesting link for some 
who may not).

    -- chris

 

Back to comp.programming | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

On Risks and Vulnerabilities of Digital Signatures Mok-Kong Shen <mok-kong.shen@t-online.de> - 2014-06-15 10:38 +0200
  Re: On Risks and Vulnerabilities of Digital Signatures "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-06-15 13:02 +0100
    Re: On Risks and Vulnerabilities of Digital Signatures Mok-Kong Shen <mok-kong.shen@t-online.de> - 2014-06-15 20:44 +0200
  Re: On Risks and Vulnerabilities of Digital Signatures Mok-Kong Shen <mok-kong.shen@t-online.de> - 2014-06-15 20:34 +0200
  Re: On Risks and Vulnerabilities of Digital Signatures Mok-Kong Shen <mok-kong.shen@t-online.de> - 2014-06-21 07:48 +0200
  Re: On Risks and Vulnerabilities of Digital Signatures Mok-Kong Shen <mok-kong.shen@t-online.de> - 2014-09-21 11:41 +0200

csiph-web