[foaf-protocols] Fwd: [Social-p2p] On the brokenness of X.509

Daniël Bos corani at gmail.com
Wed Sep 8 11:48:38 CEST 2010

On Wed, Sep 8, 2010 at 15:15, Melvin Carvalho <melvincarvalho at gmail.com> wrote:
> ---------- Forwarded message ----------
> From: Miron Cuperman <c1.nongnu at niftybox.net>
> Date: 8 September 2010 08:04
> Subject: [Social-p2p] On the brokenness of X.509
> To: social-p2p at gnu.org, social-discuss at nongnu.org
> Man in the middle attacks can be facilitated by any of a few hundred
> CA/CA-delegates:
> http://www.slate.com/id/2265204
> and a lively discussion on Schneier's blog:
> http://www.schneier.com/blog/archives/2010/09/uae_man-in-the-.html
> --
> Miron Cuperman

Disturbing as this may be, I don't see how this could be an issue for
the usage of X.509 in WebID (at least I don't see more risks than in
"normal" internet usage). To the best of my knowledge it's not
possible to generate a new certificate from a known PubKey (we would
seriously be in trouble if that were possible)

WebID uses arbitrarily signed certificates, in most cases CA's don't
even come in the picture. For security it relies on the fact that the
PubKey of the certificate it stored in the linked foaf-file, which
also is a proof that this is under the user's control.

The only additional attack vector I see is that someone could
impersonate the server hosting your foaf-file, and answer requests
from the attacked service by adding an additional PubKey. But that is
possible anyway, regardless of the security of X.509 CA's.

Daniël Bos

email  : corani at gmail.com
phone  : +31-318-711063 (Dutch) / +86-18-701330735 (Chinese)
weblog : http://blog.loadingdata.nl/
ostatus: corani at status.loadingdata.nl

More information about the foaf-protocols mailing list