Subject: it gets worse -- Microsoft warns of hijacked certificates

From: Ed Gerck <[email-masked]>
Date: Thu, 22 Mar 2001 15:33:16 -0800

http://news.cnet.com/news/0-1003-200-5222484.html?tag=tp_pr

It gets worse. As many developers in PKI have pointed out
over more than 4 years (see www.mcg.org.br/certover.pdf),
even though CAs such as VeriSign periodically generate a Certificate
Revocation List (CRL), which lists all the certificates that should be
considered invalid, this does not work for several reasons paradoxically
built into the system. Why?

As Microsoft has ignored in all these years, but now proves as its own
medicine, one reason is that VeriSign certificates do not support what they
should comply with. In Microsoft's own words:

"A field in every certificate should indicate the CRL Distribution Point
(CDP) – the location from which the CRL can be obtained. The problem is
that VeriSign code-signing certificates leave the CDP information blank.
As a result, even though VeriSign has added these two certificates to
its current CRL, it’s not possible for systems to automatically download
and check it."

The solution is a software-patch. But, what certifies the software-patch?
Maybe the guys that did this mess could also get their patch certified,
which patch would then revoke the correct certificates and leave just the
rogue ones?

Cheers -- Ed Gerck

---

From: Michael Ströder <[email-masked]>
Date: Fri, 23 Mar 2001 01:08:39 +0100

Ed Gerck wrote:
> (CDP) - the location from which the CRL can be obtained. The problem is

My intention always was that in current PKIX specs too many things
are optional.

Instead of discussing additional optional extensions (e.g. logos) we
should discuss how to build a secure and easy-to-implement PKI
system by making more details mandantory or leave them out
completely.

Ciao, Michael.