Full Disclosure mailing list archives
how would browser vendors deal with $O(10^k)$ fake certs?
From: Georgi Guninski <guninski () guninski com>
Date: Sun, 10 Apr 2011 18:55:17 +0300
how would browser vendors deal with $O(10^k)$ fake certs? recently, most browser vendors panicly issued binary updates because of $O(10^1)$ fake server certs. what does analytic number theory says about replacing the constant $1$ by a variable $k$? i.e.: what would do most browser vendors do if they find $O(10^k)$ fake server certs (possibly from different RA) {one assume $k$ is not **that** big} [god forbid CA certs]? appears to me getting the certs is one time cost to the attacker, while checking 10^k c3rt s3r34l numbers (as in the panic patch) requires loop to 10^k? _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- how would browser vendors deal with $O(10^k)$ fake certs? Georgi Guninski (Apr 10)
- Re: how would browser vendors deal with $O(10^k)$ fake certs? Pavel Kankovsky (Apr 10)
- Re: how would browser vendors deal with $O(10^k)$ fake certs? Marsh Ray (Apr 13)
- Re: how would browser vendors deal with $O(10^k)$ fake certs? Pavel Kankovsky (Apr 17)
- Re: how would browser vendors deal with $O(10^k)$ fake certs? Marsh Ray (Apr 13)
- Re: how would browser vendors deal with $O(10^k)$ fake certs? Pavel Kankovsky (Apr 10)