Certificate Authorities and Public Keys How they work and 10+ ways to hack them. -- FoxGuard Solutions Www.FoxGuardSolutions.com melkins@foxguardsolutions.com Version.05 9/2012 1
Certificate Use Overview 2
Symmetric Key Encryption Internet Reversible 3
Asymmetric Key Encryption Internet RSA RSA Reversible 4
RSA Algorithm 5
Hashing Non-reversible Repeatable Collision Resistant 6
Certificates- Additional Details 7
Uses of Certificates Code Signing updates Message Signing SSL /TLS https 8
Attacks 9
Attacks Against RSA RSA 10
Legitimate Signing of Malicious Code / Messages 11
Obtaining a Legitimate Signature for Someone Else via Social Engineering 12
Hacking a Registration Authority 13
Hacking the Private Key Owner 14
Bypassing Keys e.g. SSL Strip 15
Hash Collision Attacks 16
Implementation Failures 17
Addition of Certificates 18
Poor Random Number Generators 19
Social Engineering the User 20
Foreign Nation Strong Arm of CA 21
Frankenstein Style Attacks 22
Revocation List Attacks 23
Questions 24