[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Spoofing HTTP server certificates
In article <[email protected]>, [email protected] (Bill Stewart) writes:
> At 12:52 AM 10/2/95 -0400, Greg Miller <[email protected]> wrote:
> > Since there has been a lot of talk about the "man in the middle"
> >attack on the secure web servers, has anyone actually considered the
> >processing time required to fake a certificate from scratch?
> > I haven't really familiarized myself with how the certificates
> >are generated, etc, but it's my understanding that they are signed with RSA.
>
> While I haven't seen Verisign's various public keys posted to the net,
> and didn't see them anywhere on their web page, I assume they're at least
> 508 bits long, and the ones for better-than-personna certification
> (or at least Class 3) ought to be ~1024 bits long, unless they're limiting
> themselves to 512 bits to support software that's limited by ITAR stupidity
> (which would be a shame, but is certainly possible.)
You can see the certificate(including public key) for RSA/Verisign's
sercure server authority by looking at:
http://home.netscape.com/newsref/ref/rsa-server-ca.html
It is a >1000 bit key.
--Jeff
--
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
[email protected] - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.