CAcert System Admins discussion list

[Ian G <iang AT iang.org>]

On 30/7/09 16:07, Henrik Heigl - cacert.org wrote:
> Hy there,
>
> in the past we also have to deal with the news from SSL attacks. There
> is a new one:
> http://blogs.itworldcanada.com/security/2009/07/30/learnings-from-blackhat-new-attacks-on-ssl/
> So I ask if there is anything to say here from CAcert?! I want to send
> out some PR on that...


OK, good question!  We are supposed to be leaders in security :)

The article is fairly light, so not a lot to say.  If there are better 
articles like the actual presentations, that might help...

However, it does indicate that there are some attacks to do with 
inserting nulls into the certificate requests ... not entirely clear.

So one thing we could do is ask the technical people, whether there is 
any reason to believe that CAcert can issue false certificates by means 
of inserting nulls in the CommmonName or subjectAltName?

This would likely involve either reading the source, or trying it. 
Hence the wider CC lines.



iang

PS: ah, the evils of cross-posting :)