怎么证明second preimagewater resistant手表不代表collisionwater resistant手表

来源：蜘蛛抓取(WebSpider) 时间：2015-10-08 06:36 标签： resistant
MD5 and Perspectives
MD5 and Perspectives
last updated 1-1-2009
A group of researchers recently announced an attack that subverts the
public key infrastructure (PKI) used by web
browsers to authenticate servers when using HTTPS.
As described in the
the researchers exploit MD5 collisions
to create a rogue Certificate Authority (CA) certificate
capable of create malicious server certificates that are
trusted by all major browsers.
We have received a good number of questions about how this announcement
affects Perspectives.
As described
, Perspectives can help users
detect malicious certificates such as those generated by the rogue CA.
Additionally, we describe why the attack used in this work
even though Perspectives uses MD5.
Attack Overview: Using MD5 Collisions to Create a Rogue CA
Please read their
for details, this is just a high-level overview.
As noted by the authors, their attack uses an MD5 weakness has been
well-known for some time.
The main contribution of their work is crafting a real-world attack
by leveraging the poor security practices of some CAs.
To understand the implications (and limitations) of the MD5 vulnerability,
it necessary
to distinguish between two properties of cryptographic hash functions:
Collision Resistance:
A hash function H is collision resistant
if it is hard to find two different messages m1 and m2 such that H(m1) == H(m2)
Second Preimage Resistance
A hash function H is second
preimage resistant if given a message m1, it is hard to find a second
message m2 different from m1 such that H(m1) == H(m2)
The difference is subtle but important: it is much easier to
break collision resistance than it is to break second preimage resistance,
a collision resistance attacker has the flexibility to choose both
m1 and m2 in a way that makes finding a collision easier.
MD5 collision resistance is known to be broken, but second-preimage
resistance is not. The rogue CA attack uses a weakness in MD5 collision
resistance to undermine the traditional CA trust model used by browsers.
As described below, Perspectives requires only second preimage resistance
The published attack creates a rogue CA certificate using an MD5 collision.
In terms of the above definition, the researchers create a file m1 that is
a certificate request for a domain name the researchers legitimately own.
They then pay a real CA that is trusted by all browsers
to grant a certificate for m1.
The attack arises from the fact that the researchers were also able to
create a file m2 that is a malicious certificate request claiming that the
researchers are
themselves a trusted CA.
While a legitimate CA would never generate a
certificate saying that the researchers are a CA, the researchers can actually
generate the certificate
themselves using the signature of the valid certificate (created from m1).
Why does this work?
Well, when a CA creates the signature in a certificate,
for efficiency, it computes the signature over the hash of the data in the
certificate request.
Thus, since the researchers
found a collision H(m1) == H(m2), the signature in the original valid
certificate will also work as a signature for the malicious certificate.
Once the researchers have a rogue CA certificate that browsers will
trust as a valid
CA certificate, they can use that CA certificate to grant themselves a
certificate for ANY domain name.
This would allow them to impersonate
Google, your bank, or just about any other HTTPS website.
That is scary!本文档版权归作者及期刊出版社所有，这些文档是本人从互联网上搜集所得仅供个人和..
扫扫二维码，随身浏览文档
手机或平板扫扫即可继续访问
一种基于分组密码的hash函数
举报该文档为侵权文档。
举报该文档含有违规或不良信息。
反馈该文档无法正常浏览。
举报该文档为重复文档。
推荐理由：
将文档分享至：
分享完整地址
文档地址：
粘贴到BBS或博客
flash地址：
支持嵌入FLASH地址的网站使用
html代码：
&embed src='/DocinViewer-.swf' width='100%' height='600' type=application/x-shockwave-flash ALLOWFULLSCREEN='true' ALLOWSCRIPTACCESS='always'&&/embed&
450px*300px480px*400px650px*490px
支持嵌入HTML代码的网站使用
您的内容已经提交成功
您所提交的内容需要审核后才能发布，请您等待！
3秒自动关闭窗口

我要回帖

更多关于 resistant 的文章

 

随机推荐