Re: [TLS] simplistic renego protection

[Kyle Hamilton <[e-mail]>]

The most simple fix for a 1023-bit key is to force the high bit to
always be 1.  (This was implemented in PGP 5 for RSA keys.)

Who was the EV issuer?

-Kyle H

On Wed, Nov 25, 2009 at 5:08 PM, Peter Gutmann
<[e-mail]> wrote:
> "Yngve Nysaeter Pettersen" <[e-mail]> writes:
>
>>The reason I was investigating the site was that the EV indication was flip-
>>flopping on this site, which turned out to be because one certificate had a
>>1024 bit key (which qualifies for EV), the other was using a 1023 bit key
>>(which does not qualify for EV).
>
> So the CA issued a certificate that it should never have issued?  And then the
> client did more checking than the CA did?  Do other implementations perform
> this level of checking of EV conditions as well, or do they just assume that
> if the EV flag is set then everything must be OK because the CA says it is?
> I'd be interested in feedback from on this one (private is OK if you don't feel
> like making it public).
>
> Kinda scary if it's left to the RP to do the CA's work...
>
> Peter.
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls
>