Re: [saag] Further MD5 breaks: Creating a rogue CA certificate

[Philipp Guehring <[e-mail]>]

Hi,

> CAs should have stopped issuing certs with MD5 signatures 4 years ago,  
> when the first practical attacks on MD5 were published.

That's what nearly all of the CA's actually did back then.
But due to the all-for-one and one-for-all problem, that wasn't enough,
and it seems that our auditors forgot to care about it.

> Now it would be more correct to say that "relying parties should treat  
> as invalid any certificate chain that contains an MD5 (or MD2, MD4)  
> signature"

Yes, except for the root certificates / trust anchors.

> Since in the HTTPS context the relying parties are the browsers, it  
> falls to the vendors (if Microsoft leads, everyone will follow) to, as  
> Paul said, yank the trust anchors.

The trust anchors are the wrong place to attack the problem.

> It should be noted, though, that yanking the trust anchors is not  
> enough. You really should change the relying party to not recognize  
> this algorithm. Otherwise, it's perfectly valid for a CA whose  
> certificate is signed with SHA1 to sign an intermediate CA certificate  
> with MD5 (although they usually don't do that, I hope)

I also thought so, but then I realized that if we invalidate MD5
completely, then we would also invalidate root certificates that are MD5
self-signed, which isn't a security issue. So that would give lots of
unnecessary false-positives.

I would like to propose the following idea:

We should define a date for expiring MD5 in certificate chains for the
Internet. I would suggest the 1. June 2009, which is 6 months from now.
All software should present or log warnings in case a MD5 signature is
detected in the certificate chain (except for the self-signatures of the
root certificates) before the 1. June 2009.
The warning should state that this certificate is considered insecure
and will stop functioning on 1. June 2009.
After 1. June 2009, SSL- and digital-signature-creation applications
should treat MD5 signatures should as invalid.
After 1. June 2009, Digital signature verification applications should
warn the user that MD5 signatures have been abandoned on 1. June 2009

I think if we can agree on a date to expire MD5, and inform the media
and the users through the warnings about the expiry date

There is already a Firefox extension that warns about the certificates:
http://codefromthe70s.org/sslblacklist.aspx

Best regards,
Philipp Gühring
_______________________________________________
saag mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/saag